array-len-dup-overflow.patch

--- a/codegen/valaccodearraymodule.vala
+++ b/codegen.valaccodearraymodule.vala
@@ -583,8 +583,8 @@ public class Vala.CCodeArrayModule : CCo
 			CCodeExpression length_expr = new CCodeIdentifier ("length");
 			CCodeBinaryOperator length_check_op;
 			// add extra item to have array NULL-terminated for all reference types
+			length_expr = new CCodeBinaryExpression (CCodeBinaryOperator.PLUS, length_expr, new CCodeConstant ("1"));
 			if (array_type.element_type.type_symbol != null && array_type.element_type.type_symbol.is_reference_type ()) {
-				length_expr = new CCodeBinaryExpression (CCodeBinaryOperator.PLUS, length_expr, new CCodeConstant ("1"));
 				length_check_op = CCodeBinaryOperator.GREATER_THAN_OR_EQUAL;
 			} else {
 				length_check_op = CCodeBinaryOperator.GREATER_THAN;
--- a/codegen/valaccodearraymodule.c
+++ b/codegen/valaccodearraymodule.c
@@ -3032,11 +3032,15 @@ vala_ccode_array_module_generate_array_d
 		ValaCCodeExpression* length_expr = NULL;
 		ValaCCodeIdentifier* _tmp57_;
 		ValaCCodeBinaryOperator length_check_op = 0;
-		gboolean _tmp58_ = FALSE;
-		ValaDataType* _tmp59_;
-		ValaDataType* _tmp60_;
-		ValaTypeSymbol* _tmp61_;
-		ValaTypeSymbol* _tmp62_;
+		ValaCCodeExpression* _tmp58_;
+		ValaCCodeConstant* _tmp59_;
+		ValaCCodeConstant* _tmp60_;
+		ValaCCodeBinaryExpression* _tmp61_;
+		gboolean _tmp62_ = FALSE;
+		ValaDataType* _tmp63_;
+		ValaDataType* _tmp64_;
+		ValaTypeSymbol* _tmp65_;
+		ValaTypeSymbol* _tmp66_;
 		ValaCCodeFunctionCall* _tmp71_;
 		ValaCCodeExpression* _tmp72_;
 		ValaCodeContext* _tmp73_;
@@ -3170,35 +3174,31 @@ vala_ccode_array_module_generate_array_d
 		}
 		_tmp57_ = vala_ccode_identifier_new ("length");
 		length_expr = (ValaCCodeExpression*) _tmp57_;
-		_tmp59_ = vala_array_type_get_element_type (array_type);
+		_tmp58_ = length_expr;
+		_tmp59_ = vala_ccode_constant_new ("1");
 		_tmp60_ = _tmp59_;
-		_tmp61_ = vala_data_type_get_type_symbol (_tmp60_);
-		_tmp62_ = _tmp61_;
-		if (_tmp62_ != NULL) {
-			ValaDataType* _tmp63_;
-			ValaDataType* _tmp64_;
-			ValaTypeSymbol* _tmp65_;
-			ValaTypeSymbol* _tmp66_;
-			_tmp63_ = vala_array_type_get_element_type (array_type);
-			_tmp64_ = _tmp63_;
-			_tmp65_ = vala_data_type_get_type_symbol (_tmp64_);
-			_tmp66_ = _tmp65_;
-			_tmp58_ = vala_typesymbol_is_reference_type (_tmp66_);
+		_tmp61_ = vala_ccode_binary_expression_new (VALA_CCODE_BINARY_OPERATOR_PLUS, _tmp58_, (ValaCCodeExpression*) _tmp60_);
+		_vala_ccode_node_unref0 (length_expr);
+		length_expr = (ValaCCodeExpression*) _tmp61_;
+		_vala_ccode_node_unref0 (_tmp60_);
+		_tmp63_ = vala_array_type_get_element_type (array_type);
+		_tmp64_ = _tmp63_;
+		_tmp65_ = vala_data_type_get_type_symbol (_tmp64_);
+		_tmp66_ = _tmp65_;
+		if (_tmp66_ != NULL) {
+			ValaDataType* _tmp67_;
+			ValaDataType* _tmp68_;
+			ValaTypeSymbol* _tmp69_;
+			ValaTypeSymbol* _tmp70_;
+			_tmp67_ = vala_array_type_get_element_type (array_type);
+			_tmp68_ = _tmp67_;
+			_tmp69_ = vala_data_type_get_type_symbol (_tmp68_);
+			_tmp70_ = _tmp69_;
+			_tmp62_ = vala_typesymbol_is_reference_type (_tmp70_);
 		} else {
-			_tmp58_ = FALSE;
+			_tmp62_ = FALSE;
 		}
-		if (_tmp58_) {
-			ValaCCodeExpression* _tmp67_;
-			ValaCCodeConstant* _tmp68_;
-			ValaCCodeConstant* _tmp69_;
-			ValaCCodeBinaryExpression* _tmp70_;
-			_tmp67_ = length_expr;
-			_tmp68_ = vala_ccode_constant_new ("1");
-			_tmp69_ = _tmp68_;
-			_tmp70_ = vala_ccode_binary_expression_new (VALA_CCODE_BINARY_OPERATOR_PLUS, _tmp67_, (ValaCCodeExpression*) _tmp69_);
-			_vala_ccode_node_unref0 (length_expr);
-			length_expr = (ValaCCodeExpression*) _tmp70_;
-			_vala_ccode_node_unref0 (_tmp69_);
+		if (_tmp62_) {
 			length_check_op = VALA_CCODE_BINARY_OPERATOR_GREATER_THAN_OR_EQUAL;
 		} else {
 			length_check_op = VALA_CCODE_BINARY_OPERATOR_GREATER_THAN;

--- a/tests/arrays/empty-length-0.c-expected
+++ b/tests/arrays/empty-length-0.c-expected
@@ -215,7 +215,7 @@ _vala_array_dup3 (Manam* self,
 	if (length > 0) {
 		Manam* result;
 		gssize i;
-		result = g_new0 (Manam, length);
+		result = g_new0 (Manam, length + 1);
 		for (i = 0; i < length; i++) {
 			Manam _tmp0_;
 			Manam _tmp1_ = {0};
--- a/tests/generics/arrays.c-expected
+++ b/tests/generics/arrays.c-expected
@@ -131,7 +131,7 @@ _vala_array_dup1 (gpointer* self,
 	if (length > 0) {
 		gpointer* result;
 		gssize i;
-		result = g_new0 (gpointer, length);
+		result = g_new0 (gpointer, length + 1);
 		for (i = 0; i < length; i++) {
 			gpointer _tmp0_;
 			_tmp0_ = ((self[i] != NULL) && (g_dup_func != NULL)) ? g_dup_func ((gpointer) self[i]) : ((gpointer) self[i]);
@@ -426,7 +426,7 @@ _vala_array_dup2 (gpointer* self,
 	if (length > 0) {
 		gpointer* result;
 		gssize i;
-		result = g_new0 (gpointer, length);
+		result = g_new0 (gpointer, length + 1);
 		for (i = 0; i < length; i++) {
 			gpointer _tmp0_;
 			_tmp0_ = ((self[i] != NULL) && (g_dup_func != NULL)) ? g_dup_func ((gpointer) self[i]) : ((gpointer) self[i]);
--- a/tests/posix/empty-length-0.c-expected
+++ b/tests/posix/empty-length-0.c-expected
@@ -197,7 +197,7 @@ _vala_array_dup3 (Manam* self,
 	if (length > 0) {
 		Manam* result;
 		ssize_t i;
-		result = calloc (length, sizeof (Manam));
+		result = calloc (length + 1, sizeof (Manam));
 		for (i = 0; i < length; i++) {
 			Manam _tmp0_;
 			Manam _tmp1_ = {0};
--- a/tests/objects/property-array.c-expected
+++ b/tests/objects/property-array.c-expected
@@ -316,7 +316,7 @@ _vala_array_dup1 (Manam** self,
 	if (length > 0) {
 		Manam** result;
 		gssize i;
-		result = g_new0 (Manam*, length);
+		result = g_new0 (Manam*, length + 1);
 		for (i = 0; i < length; i++) {
 			Manam* _tmp0_;
 			_tmp0_ = _manam_dup0 (self[i]);
@@ -398,7 +398,7 @@ _vala_array_dup2 (Manam** self,
 	if (length > 0) {
 		Manam** result;
 		gssize i;
-		result = g_new0 (Manam*, length);
+		result = g_new0 (Manam*, length + 1);
 		for (i = 0; i < length; i++) {
 			Manam* _tmp0_;
 			_tmp0_ = _manam_dup0 (self[i]);
@@ -446,7 +446,7 @@ _vala_array_dup3 (Manam** self,
 	if (length > 0) {
 		Manam** result;
 		gssize i;
-		result = g_new0 (Manam*, length);
+		result = g_new0 (Manam*, length + 1);
 		for (i = 0; i < length; i++) {
 			Manam* _tmp0_;
 			_tmp0_ = _manam_dup0 (self[i]);
@@ -515,7 +515,7 @@ _vala_array_dup4 (Manam** self,
 	if (length > 0) {
 		Manam** result;
 		gssize i;
-		result = g_new0 (Manam*, length);
+		result = g_new0 (Manam*, length + 1);
 		for (i = 0; i < length; i++) {
 			Manam* _tmp0_;
 			_tmp0_ = _manam_dup0 (self[i]);
@@ -908,7 +908,7 @@ _vala_array_dup7 (Manam** self,
 	if (length > 0) {
 		Manam** result;
 		gssize i;
-		result = g_new0 (Manam*, length);
+		result = g_new0 (Manam*, length + 1);
 		for (i = 0; i < length; i++) {
 			Manam* _tmp0_;
 			_tmp0_ = _manam_dup0 (self[i]);
@@ -982,7 +982,7 @@ _vala_array_dup8 (Manam** self,
 	if (length > 0) {
 		Manam** result;
 		gssize i;
-		result = g_new0 (Manam*, length);
+		result = g_new0 (Manam*, length + 1);
 		for (i = 0; i < length; i++) {
 			Manam* _tmp0_;
 			_tmp0_ = _manam_dup0 (self[i]);