From cbfa0c44184748728a600fd69e14c5937497618c Mon Sep 17 00:00:00 2001
From: blackpawn <jim@blackpawn.com>
Date: Wed, 2 Dec 2015 01:16:29 -0600
Subject: [PATCH] Fix stb_arr_insertn and stb_arr_deleten memmove lengths

They were moving memory beyond the array bounds.
---
 stb.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stb.h b/stb.h
index d8aaf37..2d9dab6 100644
--- a/stb.h
+++ b/stb.h
@@ -3249,7 +3249,7 @@ void stb__arr_insertn_(void **pp, int size, int i, int n  STB__PARAMS)
 
       z = stb_arr_len2(p);
       stb__arr_addlen_(&p, size, i  STB__ARGS);
-      memmove((char *) p + (i+n)*size, (char *) p + i*size, size * (z-i));
+      memmove((char *) p + (i+n)*size, (char *) p + i*size, size * (z-(i+n)));
    }
    *pp = p;
 }
@@ -3258,7 +3258,7 @@ void stb__arr_deleten_(void **pp, int size, int i, int n  STB__PARAMS)
 {
    void *p = *pp;
    if (n) {
-      memmove((char *) p + i*size, (char *) p + (i+n)*size, size * (stb_arr_len2(p)-i));
+      memmove((char *) p + i*size, (char *) p + (i+n)*size, size * (stb_arr_len2(p)-(i+n)));
       stb_arrhead2(p)->len -= n;
    }
    *pp = p;