Fixed two buffer handling errors in vector.c

- remove() would read one-past array bounds.
- resize() would fail if the initial size was 1, because it multiplied by 1.75
  and truncated the resulting value. The buffer would always remain at size 1,
  but elements would repeatedly be appended (via insert()) causing a crash.

1 files changed, 2 insertions, 2 deletions

diff --git a/src/vector.c b/src/vector.c
index 47e8ce845..325f34306 100644
--- a/src/vector.c
+++ b/src/vector.c
@@ -34,7 +34,7 @@ static int resize_vector(git_vector *v)
 {
 	void **new_contents;
 
-	v->_alloc_size = (unsigned int)(v->_alloc_size * resize_factor);
+	v->_alloc_size = ((unsigned int)(v->_alloc_size * resize_factor)) + 1;
 	if (v->_alloc_size == 0)
 		v->_alloc_size = minimum_size;
 
@@ -130,7 +130,7 @@ int git_vector_remove(git_vector *v, unsigned int idx)
 	if (idx >= v->length || v->length == 0)
 		return GIT_ENOTFOUND;
 
-	for (i = idx; i < v->length; ++i)
+	for (i = idx; i < v->length - 1; ++i)
 		v->contents[i] = v->contents[i + 1];
 
 	v->length--;