Fix buffer overrun in wxPrintf() format parsing code.
Parsing a format specifier with an asterisk (e.g. "%.*s") for the 64th argument of wxPrintf() resulted in a buffer overrun as the check for the maximal number of arguments didn't break out from the right loop. Fix this by inserting an extra check for this. Thanks Coverity for finding this one.
This commit is contained in:
parent
d6406db6ed
commit
0c223a8146
@ -870,6 +870,11 @@ struct wxPrintfConvSpecParser
|
||||
|
||||
spec = &specs[nargs];
|
||||
}
|
||||
|
||||
// If we hit the maximal number of arguments inside the inner
|
||||
// loop, break out of the outer one as well.
|
||||
if ( nargs == wxMAX_SVNPRINTF_ARGUMENTS )
|
||||
break;
|
||||
}
|
||||
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user