AuroraMiddleware/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Avoid integer overflow/wraparound in wxString::Mid().

Browse Source 
Don't compare nLength with "nFirst + nCount" as this could wrap around.

Compare nCount with maximal allowed count, after ensuring that nFirst itself
is valid first, instead.

Closes #16572.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@77749 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
This commit is contained in:
Vadim Zeitlin 2014-09-20 22:07:48 +00:00
parent 4d561bf02c
commit 51791822a1
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/common/string.cpp
View File

@ -1242,17 +1242,17 @@ wxString wxString::Mid(size_t nFirst, size_t nCount) const
} }
// out-of-bounds requests return sensible things // out-of-bounds requests return sensible things
if ( nFirst + nCount > nLen )
{
nCount = nLen - nFirst;
}
if ( nFirst > nLen ) if ( nFirst > nLen )
{ {
// AllocCopy() will return empty string // AllocCopy() will return empty string
return wxEmptyString; return wxEmptyString;
} }
if ( nCount > nLen - nFirst )
{
nCount = nLen - nFirst;
}
wxString dest(*this, nFirst, nCount); wxString dest(*this, nFirst, nCount);
if ( dest.length() != nCount ) if ( dest.length() != nCount )
{ {