array: fix off by one error in array_remove

If the array was full, attempting to remove an element caused an out
of bounds memory access.

As an example this was triggered when reaching the capacity limit of
the jumplist. It can be forced by repeatedly searching for something
(i.e. `/.` and then holding down `n`).

1 files changed, 1 insertions, 1 deletions

diff --git a/array.c b/array.c
index 824154a..c68279f 100644
--- a/array.c
+++ b/array.c
@@ -119,7 +119,7 @@ bool array_remove(Array *arr, size_t idx) {
 	}
 	char *dest = arr->items + idx * arr->elem_size;
 	char *src = arr->items + (idx + 1) * arr->elem_size;
-	memmove(dest, src, (arr->len - idx) * arr->elem_size);
+	memmove(dest, src, (arr->len - idx - 1) * arr->elem_size);
 	arr->len--;
 	return true;
 }