CFData: fix CFDataReplaceBytes length miscalculation (heap overflow)

Source/CFData.c

@@ -342,12 +342,12 @@ CFDataReplaceBytes (CFMutableDataRef d, CFRange range,
     return;
 
   md = (struct __CFMutableData*)d;
-  assert (range.location + range.length <= md->_capacity);
-  
-  newBufLen = range.location + newLength;
+  assert (range.location + range.length <= md->_length);
+
+  newBufLen = md->_length - range.length + newLength;
   CFDataCheckCapacityAndGrow (d, newBufLen);
-  
-  if (newLength != range.length && range.location + range.length < newBufLen)
+
+  if (newLength != range.length && range.location + range.length < md->_length)
     {
       UInt8 *moveFrom = md->_contents + range.location + range.length;
       UInt8 *moveTo = md->_contents + range.location + newLength;

Tests/CFData/replacebytes.m

@@ -0,0 +1,37 @@
+#include "CoreFoundation/CFData.h"
+#include "../CFTesting.h"
+
+/* CFDataReplaceBytes and CFDataDeleteBytes preserve the tail after the edited range. */
+
+const UInt8 src[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 };
+const UInt8 ins[] = { 0xAA, 0xBB, 0xCC, 0xDD };
+
+int main (void)
+{
+  CFMutableDataRef d;
+  const UInt8 *p;
+
+  /* Grow a middle range: replace (2,3) with 4 bytes -> length 10-3+4 = 11,
+   * tail {5..9} preserved after the inserted bytes. */
+  d = CFDataCreateMutable (NULL, 0);
+  CFDataAppendBytes (d, src, sizeof(src));
+  CFDataReplaceBytes (d, CFRangeMake(2, 3), ins, sizeof(ins));
+  PASS_CF(CFDataGetLength(d) == 11, "Grow replace yields correct length.");
+  p = CFDataGetBytePtr(d);
+  PASS_CF(p[0] == 0 && p[1] == 1, "Prefix preserved.");
+  PASS_CF(p[2] == 0xAA && p[5] == 0xDD, "Inserted bytes present.");
+  PASS_CF(p[6] == 5 && p[10] == 9, "Tail preserved after grow.");
+  CFRelease (d);
+
+  /* Delete a middle range: delete (2,3) -> length 7, tail {5..9} shifts down. */
+  d = CFDataCreateMutable (NULL, 0);
+  CFDataAppendBytes (d, src, sizeof(src));
+  CFDataDeleteBytes (d, CFRangeMake(2, 3));
+  PASS_CF(CFDataGetLength(d) == 7, "Delete yields correct length.");
+  p = CFDataGetBytePtr(d);
+  PASS_CF(p[0] == 0 && p[1] == 1 && p[2] == 5 && p[6] == 9,
+    "Tail preserved after delete.");
+  CFRelease (d);
+
+  return 0;
+}