From 8b6a10aefa5ae660e9d13a8e55933125b257ab6c Mon Sep 17 00:00:00 2001
From: moneta <lorenzo.moneta@cern.ch>
Date: Fri, 25 Feb 2022 09:54:40 +0100
Subject: [PATCH] Fix an array overflow in interpolating RooHistPdf when the
 interpolation order is >= 10.

---
 roofit/roofitcore/src/RooDataHist.cxx | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/roofit/roofitcore/src/RooDataHist.cxx b/roofit/roofitcore/src/RooDataHist.cxx
index c293a8fbb1..2159f73093 100644
--- a/roofit/roofitcore/src/RooDataHist.cxx
+++ b/roofit/roofitcore/src/RooDataHist.cxx
@@ -1206,9 +1206,9 @@ double RooDataHist::weightInterpolated(const RooArgSet& bin, int intOrder, bool
 
     auto idxMultY = _idxMult[varInfo.realVarIdx2];
     auto offsetIdx = centralIdx - idxMultY * ybinC;
-    
-    double yarr[10] = {} ;
-    double xarr[10] = {} ;
+
+    std::vector<double> yarr(intOrder+1);
+    std::vector<double> xarr(intOrder+1);
     for (int i=ybinLo ; i<=intOrder+ybinLo ; i++) {
       int ibin ;
       if (i>=0 && i<ybinM) {
@@ -1236,7 +1236,7 @@ double RooDataHist::weightInterpolated(const RooArgSet& bin, int intOrder, bool
       for (int q=0; q<=intOrder ; q++) cout << yarr[q] << " " ;
       cout << endl ;
     }
-    wInt = RooMath::interpolate(xarr,yarr,intOrder+1,yval) ;
+    wInt = RooMath::interpolate(xarr.data(),yarr.data(),intOrder+1,yval) ;
 
   } else {
 
@@ -1344,8 +1344,8 @@ double RooDataHist::interpolateDim(int iDim, double xval, size_t centralIdx, int
   auto idxMult = _idxMult[iDim];
   auto offsetIdx = centralIdx - idxMult * fbinC;
 
-  double yarr[10] ;
-  double xarr[10] ;
+  std::vector<double> yarr(intOrder+1) ;
+  std::vector<double> xarr(intOrder+1);
   for (int i=fbinLo ; i<=intOrder+fbinLo ; i++) {
     int ibin ;
     if (i>=0 && i<fbinM) {
@@ -1383,7 +1383,7 @@ double RooDataHist::interpolateDim(int iDim, double xval, size_t centralIdx, int
       }
     }
   }
-  return RooMath::interpolate(xarr,yarr,intOrder+1,xval) ;
+  return RooMath::interpolate(xarr.data(),yarr.data(),intOrder+1,xval) ;
 }
 
 
-- 
2.35.1