Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix off by one errors and buffer overflows in wxURLDataObject.

Browse Source 
Backport of r61787 and r61788 from trunk.

Closes #11102.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/branches/WX_2_8_BRANCH@61814 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
This commit is contained in:
Vadim Zeitlin
2009-09-03 00:32:09 +00:00
parent 0ce4ea896d
commit 1a0b69436c
1 changed files with 40 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
src/msw/ole/dataobj.cpp
View File

@@ -1196,24 +1196,7 @@ public:
return buffer; return buffer;
} }
#if wxUSE_UNICODE wxDECLARE_NO_COPY_CLASS(CFSTR_SHELLURLDataObject);
virtual bool GetDataHere( void* buffer ) const
{
// CFSTR_SHELLURL is _always_ ANSI!
wxCharBuffer char_buffer( GetDataSize() );
wxCustomDataObject::GetDataHere( (void*)char_buffer.data() );
wxString unicode_buffer( char_buffer, wxConvLibc );
memcpy( buffer, unicode_buffer.c_str(),
( unicode_buffer.length() + 1 ) * sizeof(wxChar) );
return true;
}
virtual bool GetDataHere(const wxDataFormat& WXUNUSED(format),
void *buf) const
{ return GetDataHere(buf); }
#endif
DECLARE_NO_COPY_CLASS(CFSTR_SHELLURLDataObject)
}; };
@@ -1248,28 +1231,57 @@ bool wxURLDataObject::SetData(const wxDataFormat& format,
wxString wxURLDataObject::GetURL() const wxString wxURLDataObject::GetURL() const
{ {
wxString url; wxString url;
wxCHECK_MSG( m_dataObjectLast, url, _T("no data in wxURLDataObject") ); wxCHECK_MSG( m_dataObjectLast, url, wxT("no data in wxURLDataObject") );
size_t len = m_dataObjectLast->GetDataSize(); if ( m_dataObjectLast->GetPreferredFormat() == CFSTR_SHELLURL )
{
const size_t len = m_dataObjectLast->GetDataSize();
if ( !len )
return wxString();
m_dataObjectLast->GetDataHere(wxStringBuffer(url, len)); // CFSTR_SHELLURL is always ANSI so we need to convert it from it in
// Unicode build
#if wxUSE_UNICODE
wxCharBuffer buf(len);
if ( m_dataObjectLast->GetDataHere(buf.data()) )
url = buf;
#else // !wxUSE_UNICODE
// in ANSI build no conversion is necessary
m_dataObjectLast->GetDataHere(wxStringBuffer(url, len));
#endif // wxUSE_UNICODE/!wxUSE_UNICODE
}
else // must be wxTextDataObject
{
url = static_cast<wxTextDataObject *>(m_dataObjectLast)->GetText();
}
return url; return url;
} }
void wxURLDataObject::SetURL(const wxString& url) void wxURLDataObject::SetURL(const wxString& url)
{ {
SetData(wxDataFormat(wxUSE_UNICODE ? wxDF_UNICODETEXT : wxDF_TEXT),
url.Length()+1, url.c_str());
// CFSTR_SHELLURL is always supposed to be ANSI... // CFSTR_SHELLURL is always supposed to be ANSI...
wxWX2MBbuf urlA = (wxWX2MBbuf)url.mbc_str(); wxWX2MBbuf urlMB = (wxWX2MBbuf)url.mbc_str();
if ( urlA ) if ( urlA )
{ {
size_t len = strlen(urlA); const size_t len = strlen(urlMB);
SetData(wxDataFormat(CFSTR_SHELLURL), len+1, (const char*)urlA);
#if !wxUSE_UNICODE
// wxTextDataObject takes the number of characters in the string, not
// the size of the buffer (which would be len+1)
SetData(wxDF_TEXT, len, urlMB);
#endif // !wxUSE_UNICODE
// however CFSTR_SHELLURLDataObject doesn't append NUL automatically
// but we probably still want to have it on the clipboard (just to be
// safe), so do append it
SetData(wxDataFormat(CFSTR_SHELLURL), len + 1, urlMB);
} }
//else: we can't represent this URL in the current code page
#if wxUSE_UNICODE
SetData(wxDF_UNICODETEXT, url.length()*sizeof(wxChar), url.wc_str());
#endif
} }
// ---------------------------------------------------------------------------- // ----------------------------------------------------------------------------