fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / include / wx / dynarray.h

diff --git a/include/wx/dynarray.h b/include/wx/dynarray.h
index 1fc89c9939ea1e78a6d11332c368f092b3deeae0..d50c7c19e874699b6a887f8eb4ca7ae10c1f8ed8 100644 (file)
--- a/include/wx/dynarray.h
+++ b/include/wx/dynarray.h
@@ -151,7 +151,7 @@ public:                                                             \
                                        e = rend();                  \
           for ( const_reverse_iterator i = b; i != e; ++i )         \
               if ( *i == item )                                     \
-                  return (int)(i - b);                              \
+                  return (int)(e - i - 1);                          \
       }                                                             \
       else                                                          \
       {                                                             \
@@ -546,6 +546,8 @@ public:                                                               \
                                                                       \
   size_t Add(T lItem)                                                 \
     { return base::Add(lItem, (CMPFUNC)m_fnCompare); }                \
+  void push_back(T lItem)                                             \
+    { Add(lItem); }                                                   \
                                                                       \
   void RemoveAt(size_t uiIndex, size_t nRemove = 1)                   \
     { base::erase(begin() + uiIndex, begin() + uiIndex + nRemove); }  \
@@ -636,7 +638,7 @@ private:                                                                 \
 // that wants to export a wxArray daubed with your own import/export goo.
 //
 // Finally, you can define the macro below as something special to modify the
-// arrays defined by a simple WX_FOO_ARRAY as well. By default is is empty.
+// arrays defined by a simple WX_FOO_ARRAY as well. By default is empty.
 #define wxARRAY_DEFAULT_EXPORT
 
 // ----------------------------------------------------------------------------