From ff37c961ff1006a40c843ed64129557cb4194fd6 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 8 Sep 2020 17:57:15 +0200
Subject: [PATCH] shared: fix out of bounds for nm_g_array_append_new() macro

Fixes: fb6e9795b7cf ('shared: add nm_g_array_append_new() helper')
---
 shared/nm-glib-aux/nm-shared-utils.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/shared/nm-glib-aux/nm-shared-utils.h b/shared/nm-glib-aux/nm-shared-utils.h
index aa6169d43b..2f42574d69 100644
--- a/shared/nm-glib-aux/nm-shared-utils.h
+++ b/shared/nm-glib-aux/nm-shared-utils.h
@@ -1564,14 +1564,14 @@ nm_g_array_len (const GArray *arr)
 
 #define nm_g_array_append_new(arr, type) \
 	({ \
-		GArray *_arr = (arr); \
-		gsize _l; \
+		GArray *const _arr = (arr); \
+		guint _len; \
 		\
 		nm_assert (_arr); \
-		_l = ((gsize) _arr->len) + 1u; \
-		nm_assert (_l > _arr->len); \
-		g_array_set_size (_arr, _l); \
-		&g_array_index (arr, type, _l); \
+		_len = _arr->len; \
+		nm_assert (_len < G_MAXUINT); \
+		g_array_set_size (_arr, _len + 1u); \
+		&g_array_index (arr, type, _len); \
 	})
 
 /*****************************************************************************/