From c636ccbe85cd086426dceb645dca71e7dc1d7efd Mon Sep 17 00:00:00 2001
From: Nick Terrell <terrelln@fb.com>
Date: Tue, 21 Jul 2015 11:34:55 -0700
Subject: [PATCH] Add bounds check in get_ptr.

Summary: `get_ptr()` checks if the index is past the end of the array, but it
doesn't check if it is less than 0, while `at()` does.

Reviewed By: @yfeldblum

Differential Revision: D2258548
---
 folly/dynamic.cpp          | 2 +-
 folly/test/DynamicTest.cpp | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/folly/dynamic.cpp b/folly/dynamic.cpp
index 840c5f33..e5829244 100644
--- a/folly/dynamic.cpp
+++ b/folly/dynamic.cpp
@@ -165,7 +165,7 @@ const dynamic* dynamic::get_ptr(dynamic const& idx) const {
     if (!idx.isInt()) {
       throw TypeError("int64", idx.type());
     }
-    if (idx >= parray->size()) {
+    if (idx < 0 || idx >= parray->size()) {
       return nullptr;
     }
     return &(*parray)[idx.asInt()];
diff --git a/folly/test/DynamicTest.cpp b/folly/test/DynamicTest.cpp
index e471d021..184d57f4 100644
--- a/folly/test/DynamicTest.cpp
+++ b/folly/test/DynamicTest.cpp
@@ -269,6 +269,7 @@ TEST(Dynamic, ObjectForwarding) {
 TEST(Dynamic, GetPtr) {
   dynamic array = { 1, 2, "three" };
   EXPECT_TRUE(array.get_ptr(0));
+  EXPECT_FALSE(array.get_ptr(-1));
   EXPECT_FALSE(array.get_ptr(3));
   EXPECT_EQ(dynamic("three"), *array.get_ptr(2));
   const dynamic& carray = array;
-- 
2.34.1