Fix an out of bounds read.

Change-Id: Ie7eb4cdc9c0f5002b67145f23fe8a0a3b105b626
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

diff --git a/qv4array.cpp b/qv4array.cpp
index 2316491..ab6a18e 100644 (file)
--- a/qv4array.cpp
+++ b/qv4array.cpp
@@ -526,8 +526,8 @@ Value Array::indexOf(Value v, uint fromIndex, uint endIndex, ExecutionContext *c
                 return Value::fromDouble(n->key());
         }
     } else {
-        if (endIndex > len)
-            endIndex = len;
+        if (endIndex > values.size())
+            endIndex = values.size();
         PropertyDescriptor *pd = values.data() + offset;
         PropertyDescriptor *end = pd + endIndex;
         pd += fromIndex;