Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixing overrelease and out-of-bounds write, fixes #13725

Browse Source 
git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@72996 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
This commit is contained in:
Stefan Csomor
2012-11-23 07:55:58 +00:00
parent 40aa1a7e60
commit 77c8efc8c3
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/osx/cocoa/dataview.mm
View File

@@ -926,7 +926,8 @@ outlineView:(NSOutlineView*)outlineView
size_t const dataSize = event.GetDataObject()->GetDataSize(idDataFormat); size_t const dataSize = event.GetDataObject()->GetDataSize(idDataFormat);
size_t const dataBufferSize = sizeof(wxDataFormatId)+dataSize; size_t const dataBufferSize = sizeof(wxDataFormatId)+dataSize;
// variable definitions (used in all case statements): // variable definitions (used in all case statements):
wxMemoryBuffer dataBuffer(dataBufferSize); // give additional headroom for trailing NULL
wxMemoryBuffer dataBuffer(dataBufferSize+4);
dataBuffer.AppendData(&idDataFormat,sizeof(wxDataFormatId)); dataBuffer.AppendData(&idDataFormat,sizeof(wxDataFormatId));
switch (idDataFormat) switch (idDataFormat)
@@ -958,7 +959,6 @@ outlineView:(NSOutlineView*)outlineView
break; break;
default: default:
wxFAIL_MSG("Data object has invalid or unsupported data format"); wxFAIL_MSG("Data object has invalid or unsupported data format");
[dataArray release];
return NO; return NO;
} }
} }
@@ -976,7 +976,6 @@ outlineView:(NSOutlineView*)outlineView
} }
else else
{ {
[dataArray release];
delete itemObject; delete itemObject;
return NO; // dragging was vetoed or no data available return NO; // dragging was vetoed or no data available
} }