idtree: fix overflow for v. large ids on allocation and removal

Chris Cowan tracked down a SEGV in sub_alloc: idp->level can actually
be equal to 7 (MAX_LEVEL) there, as it can be in sub_remove.

diff --git a/ccan/idtree/idtree.c b/ccan/idtree/idtree.c
index 5a26234e63318e92c06193d7e994c2a99d10e5f9..b3b1d606156a8ab79b2066cdadcfa8c8a34ef674 100644 (file)
--- a/ccan/idtree/idtree.c
+++ b/ccan/idtree/idtree.c
@@ -99,7 +99,7 @@ static int sub_alloc(struct idtree *idp, const void *ptr, int *starting_id)
 {
        int n, m, sh;
        struct idtree_layer *p, *pn;
-       struct idtree_layer *pa[MAX_LEVEL];
+       struct idtree_layer *pa[MAX_LEVEL+1];
        unsigned int l, id, oid;
        uint32_t bm;