fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / include / wx / vector.h

diff --git a/include/wx/vector.h b/include/wx/vector.h
index 74252da28e0a7c071b871447c9edb3ccf4fbce16..d558e774e603357e8a46623b21c2e7ff0f3318a1 100644 (file)
--- a/include/wx/vector.h
+++ b/include/wx/vector.h
@@ -14,26 +14,188 @@
 
 #include "wx/defs.h"
 
 
 #include "wx/defs.h"
 

-#if wxUSE_STL
+#if wxUSE_STD_CONTAINERS

 
 #include <vector>
 
 #include <vector>

+#include <algorithm>
+

 #define wxVector std::vector
 #define wxVector std::vector

+template<typename T>
+inline void wxVectorSort(wxVector<T>& v)
+{
+    std::sort(v.begin(), v.end());
+}
+
+#else // !wxUSE_STD_CONTAINERS
+
+#include "wx/utils.h"
+#include "wx/scopeguard.h"
+#include "wx/meta/movable.h"
+#include "wx/meta/if.h"
+
+#include "wx/beforestd.h"
+#include <new> // for placement new
+#include "wx/afterstd.h"
+
+namespace wxPrivate
+{
+
+// These templates encapsulate memory operations for use by wxVector; there are
+// two implementations, both in generic way for any C++ types and as an
+// optimized version for "movable" types that uses realloc() and memmove().
+
+// version for movable types:
+template<typename T>
+struct wxVectorMemOpsMovable
+{
+    static void Free(T* array)
+        { free(array); }

 
 

-#else // !wxUSE_STL
+    static T* Realloc(T* old, size_t newCapacity, size_t WXUNUSED(occupiedSize))
+        { return (T*)realloc(old, newCapacity * sizeof(T)); }
+
+    static void MemmoveBackward(T* dest, T* source, size_t count)
+        { memmove(dest, source, count * sizeof(T)); }
+
+    static void MemmoveForward(T* dest, T* source, size_t count)
+        { memmove(dest, source, count * sizeof(T)); }
+};
+
+// generic version for non-movable types:
+template<typename T>
+struct wxVectorMemOpsGeneric
+{
+    static void Free(T* array)
+        { ::operator delete(array); }
+
+    static T* Realloc(T* old, size_t newCapacity, size_t occupiedSize)
+    {
+        T *mem = (T*)::operator new(newCapacity * sizeof(T));
+        for ( size_t i = 0; i < occupiedSize; i++ )
+        {
+            ::new(mem + i) T(old[i]);
+            old[i].~T();
+        }
+        ::operator delete(old);
+        return mem;
+    }
+
+    static void MemmoveBackward(T* dest, T* source, size_t count)
+    {
+        wxASSERT( dest < source );
+        T* destptr = dest;
+        T* sourceptr = source;
+        for ( size_t i = count; i > 0; --i, ++destptr, ++sourceptr )
+        {
+            ::new(destptr) T(*sourceptr);
+            sourceptr->~T();
+        }
+    }
+
+    static void MemmoveForward(T* dest, T* source, size_t count)
+    {
+        wxASSERT( dest > source );
+        T* destptr = dest + count - 1;
+        T* sourceptr = source + count - 1;
+        for ( size_t i = count; i > 0; --i, --destptr, --sourceptr )
+        {
+            ::new(destptr) T(*sourceptr);
+            sourceptr->~T();
+        }
+    }
+};
+
+
+} // namespace wxPrivate

 
 template<typename T>
 class wxVector
 {
 
 template<typename T>
 class wxVector
 {

+private:
+    // This cryptic expression means "typedef Ops to wxVectorMemOpsMovable if
+    // type T is movable type, otherwise to wxVectorMemOpsGeneric".
+    //
+    // Note that we use typedef instead of privately deriving from this (which
+    // would allowed us to omit "Ops::" prefixes below) to keep VC6 happy,
+    // it can't compile code that derives from wxIf<...>::value.
+    //
+    // Note that bcc needs the extra parentheses for non-type template
+    // arguments to compile this expression.
+    typedef typename wxIf< (wxIsMovable<T>::value),
+                           wxPrivate::wxVectorMemOpsMovable<T>,
+                           wxPrivate::wxVectorMemOpsGeneric<T> >::value
+            Ops;
+

 public:
     typedef size_t size_type;
 public:
     typedef size_t size_type;

+    typedef size_t difference_type;

     typedef T value_type;
     typedef T value_type;

+    typedef value_type* pointer;

     typedef value_type* iterator;
     typedef const value_type* const_iterator;
     typedef value_type& reference;
 
     typedef value_type* iterator;
     typedef const value_type* const_iterator;
     typedef value_type& reference;
 

+    class reverse_iterator
+    {
+    public:
+        reverse_iterator() : m_ptr(NULL) { }
+        wxEXPLICIT reverse_iterator(iterator it) : m_ptr(it) { }
+        reverse_iterator(const reverse_iterator& it) : m_ptr(it.m_ptr) { }
+
+        reference operator*() const { return *m_ptr; }
+        pointer operator->() const { return m_ptr; }
+
+        iterator base() const { return m_ptr; }
+
+        reverse_iterator& operator++()
+            { --m_ptr; return *this; }
+        reverse_iterator operator++(int)
+            { reverse_iterator tmp = *this; --m_ptr; return tmp; }
+        reverse_iterator& operator--()
+            { ++m_ptr; return *this; }
+        reverse_iterator operator--(int)
+            { reverse_iterator tmp = *this; ++m_ptr; return tmp; }
+
+        reverse_iterator operator+(difference_type n) const
+            { return reverse_iterator(m_ptr - n); }
+        reverse_iterator& operator+=(difference_type n)
+            { m_ptr -= n; return *this; }
+        reverse_iterator operator-(difference_type n) const
+            { return reverse_iterator(m_ptr + n); }
+        reverse_iterator& operator-=(difference_type n)
+            { m_ptr += n; return *this; }
+
+        reference operator[](difference_type n) const
+            { return *(*this + n); }
+
+        bool operator ==(const reverse_iterator& it) const
+            { return m_ptr == it.m_ptr; }
+        bool operator !=(const reverse_iterator& it) const
+            { return m_ptr != it.m_ptr; }
+
+    private:
+        value_type *m_ptr;
+    };
+

     wxVector() : m_size(0), m_capacity(0), m_values(NULL) {}
 
     wxVector() : m_size(0), m_capacity(0), m_values(NULL) {}
 

-    wxVector(const wxVector& c)
+    wxVector(size_type p_size)
+        : m_size(0), m_capacity(0), m_values(NULL)
+    {
+        reserve(p_size);
+        for ( size_t n = 0; n < p_size; n++ )
+            push_back(value_type());
+    }
+
+    wxVector(size_type p_size, const value_type& v)
+        : m_size(0), m_capacity(0), m_values(NULL)
+    {
+        reserve(p_size);
+        for ( size_t n = 0; n < p_size; n++ )
+            push_back(v);
+    }
+
+    wxVector(const wxVector& c) : m_size(0), m_capacity(0), m_values(NULL)

     {
         Copy(c);
     }
     {
         Copy(c);
     }


@@ -43,11 +205,33 @@ public:
         clear();
     }
 
         clear();
     }
 

+    void assign(size_type p_size, const value_type& v)
+    {
+        clear();
+        reserve(p_size);
+        for ( size_t n = 0; n < p_size; n++ )
+            push_back(v);
+    }
+
+    void swap(wxVector& v)
+    {
+        wxSwap(m_size, v.m_size);
+        wxSwap(m_capacity, v.m_capacity);
+        wxSwap(m_values, v.m_values);
+    }
+

     void clear()
     {
     void clear()
     {

-        delete[] m_values;
+        // call destructors of stored objects:
+        for ( size_type i = 0; i < m_size; i++ )
+        {
+            m_values[i].~T();
+        }
+
+        Ops::Free(m_values);

         m_values = NULL;
         m_values = NULL;

-        m_size = m_capacity = 0;
+        m_size =
+        m_capacity = 0;

     }
 
     void reserve(size_type n)
     }
 
     void reserve(size_type n)


@@ -57,23 +241,33 @@ public:
 
         // increase the size twice, unless we're already too big or unless
         // more is requested
 
         // increase the size twice, unless we're already too big or unless
         // more is requested

-        const size_type increment = (m_size > 0)
-                                     ? wxMin(m_size, ALLOC_MAX_SIZE)
-                                     : ALLOC_INITIAL_SIZE;
+        //
+        // NB: casts to size_type are needed to suppress mingw32 warnings about
+        //     mixing enums and ints in the same expression
+        const size_type increment = m_size > 0
+                                     ? wxMin(m_size, (size_type)ALLOC_MAX_SIZE)
+                                     : (size_type)ALLOC_INITIAL_SIZE;

         if ( m_capacity + increment > n )
             n = m_capacity + increment;
 
         if ( m_capacity + increment > n )
             n = m_capacity + increment;
 

-        value_type *mem = new value_type[n];
+        m_values = Ops::Realloc(m_values, n * sizeof(value_type), m_size);
+        m_capacity = n;
+    }

 
 

-        if ( m_values )
-        {
-            for ( size_type i = 0; i < m_size; ++i )
-                mem[i] = m_values[i];
-            delete[] m_values;
-        }
+    void resize(size_type n)
+    {
+        if ( n < m_size )
+            Shrink(n);
+        else if ( n > m_size )
+            Extend(n, value_type());
+    }

 
 

-        m_values = mem;
-        m_capacity = n;
+    void resize(size_type n, const value_type& v)
+    {
+        if ( n < m_size )
+            Shrink(n);
+        else if ( n > m_size )
+            Extend(n, v);

     }
 
     size_type size() const
     }
 
     size_type size() const


@@ -93,14 +287,28 @@ public:
 
     wxVector& operator=(const wxVector& vb)
     {
 
     wxVector& operator=(const wxVector& vb)
     {

-        Copy(vb);
+        if (this != &vb)
+        {
+            clear();
+            Copy(vb);
+        }

         return *this;
     }
 
     void push_back(const value_type& v)
     {
         reserve(size() + 1);
         return *this;
     }
 
     void push_back(const value_type& v)
     {
         reserve(size() + 1);

-        m_values[m_size++] = v;
+
+        // use placement new to initialize new object in preallocated place in
+        // m_values and store 'v' in it:
+        void* const place = m_values + m_size;
+        ::new(place) value_type(v);
+
+        // only increase m_size if the ctor didn't throw an exception; notice
+        // that if it _did_ throw, everything is OK, because we only increased
+        // vector's capacity so far and possibly written some data to
+        // uninitialized memory at the end of m_values
+        m_size++;

     }
 
     void pop_back()
     }
 
     void pop_back()


@@ -132,18 +340,40 @@ public:
     const_iterator end() const { return m_values + size(); }
     iterator end() { return m_values + size(); }
 
     const_iterator end() const { return m_values + size(); }
     iterator end() { return m_values + size(); }
 

+    reverse_iterator rbegin() { return reverse_iterator(end() - 1); }
+    reverse_iterator rend() { return reverse_iterator(begin() - 1); }
+

     iterator insert(iterator it, const value_type& v = value_type())
     {
     iterator insert(iterator it, const value_type& v = value_type())
     {

-        size_t idx = it - begin();
+        // NB: this must be done before reserve(), because reserve()
+        //     invalidates iterators!
+        const size_t idx = it - begin();
+        const size_t after = end() - it;

 
         reserve(size() + 1);
 
 
         reserve(size() + 1);
 

-        // unless we're inserting at the end, move following values out of
-        // the way:
-        for ( size_t n = m_size; n != idx; --n )
-            m_values[n] = m_values[n-1];
+        // the place where the new element is going to be inserted
+        value_type * const place = m_values + idx;

 
 

-        m_values[idx] = v;
+        // unless we're inserting at the end, move following elements out of
+        // the way:
+        if ( after > 0 )
+            Ops::MemmoveForward(place + 1, place, after);
+
+        // if the ctor called below throws an exception, we need to move all
+        // the elements back to their original positions in m_values
+        wxScopeGuard moveBack = wxMakeGuard(
+                Ops::MemmoveBackward, place, place + 1, after);
+        if ( !after )
+            moveBack.Dismiss();
+
+        // use placement new to initialize new object in preallocated place in
+        // m_values and store 'v' in it:
+        ::new(place) value_type(v);
+
+        // now that we did successfully add the new element, increment the size
+        // and disable moving the items back
+        moveBack.Dismiss();

         m_size++;
 
         return begin() + idx;
         m_size++;
 
         return begin() + idx;


@@ -160,20 +390,23 @@ public:
             return first;
         wxASSERT( first < end() && last <= end() );
 
             return first;
         wxASSERT( first < end() && last <= end() );
 

-        size_type index = first - begin();
-        size_type count = last - first;
+        const size_type idx = first - begin();
+        const size_type count = last - first;
+        const size_type after = end() - last;

 
 

-        // move the remaining values over to the freed space:
-        for ( iterator i = last; i < end(); ++i )
-            *(i - count) = *i;
+        // erase elements by calling their destructors:
+        for ( iterator i = first; i < last; ++i )
+            i->~T();

 
 

-        // erase items behind the new end of m_values:
-        for ( iterator i = end() - count; i < end(); ++i )
-            *i = value_type();
+        // once that's done, move following elements over to the freed space:
+        if ( after > 0 )
+        {
+            Ops::MemmoveBackward(m_values + idx, m_values + idx + count, after);
+        }

 
         m_size -= count;
 
 
         m_size -= count;
 

-        return begin() + index;
+        return begin() + idx;

     }
 
 #if WXWIN_COMPATIBILITY_2_8
     }
 
 #if WXWIN_COMPATIBILITY_2_8


@@ -181,12 +414,12 @@ public:
 #endif // WXWIN_COMPATIBILITY_2_8
 
 private:
 #endif // WXWIN_COMPATIBILITY_2_8
 
 private:

-    static const size_type ALLOC_INITIAL_SIZE = 16;
-    static const size_type ALLOC_MAX_SIZE = 4096;
+    // VC6 can't compile static const int members
+    enum { ALLOC_INITIAL_SIZE = 16 };
+    enum { ALLOC_MAX_SIZE = 4096 };

 
     void Copy(const wxVector& vb)
     {
 
     void Copy(const wxVector& vb)
     {

-        clear();

         reserve(vb.size());
 
         for ( const_iterator i = vb.begin(); i != vb.end(); ++i )
         reserve(vb.size());
 
         for ( const_iterator i = vb.begin(); i != vb.end(); ++i )


@@ -194,6 +427,20 @@ private:
     }
 
 private:
     }
 
 private:

+    void Shrink(size_type n)
+    {
+        for ( size_type i = n; i < m_size; i++ )
+            m_values[i].~T();
+        m_size = n;
+    }
+
+    void Extend(size_type n, const value_type& v)
+    {
+        reserve(n);
+        for ( size_type i = m_size; i < n; i++ )
+            push_back(v);
+    }
+

     size_type m_size,
               m_capacity;
     value_type *m_values;
     size_type m_size,
               m_capacity;
     value_type *m_values;


@@ -201,14 +448,52 @@ private:
 
 #if WXWIN_COMPATIBILITY_2_8
 template<typename T>
 
 #if WXWIN_COMPATIBILITY_2_8
 template<typename T>

-typename wxVector<T>::size_type wxVector<T>::erase(size_type n)
+inline typename wxVector<T>::size_type wxVector<T>::erase(size_type n)

 {
     erase(begin() + n);
     return n;
 }
 #endif // WXWIN_COMPATIBILITY_2_8
 
 {
     erase(begin() + n);
     return n;
 }
 #endif // WXWIN_COMPATIBILITY_2_8
 

-#endif // wxUSE_STL/!wxUSE_STL
+
+
+namespace wxPrivate
+{
+
+// This is a helper for the wxVectorSort function, and should not be used
+// directly in user's code.
+template<typename T>
+struct wxVectorComparator
+{
+    static int
+    Compare(const void* pitem1, const void* pitem2, const void* )
+    {
+        const T& item1 = *reinterpret_cast<const T*>(pitem1);
+        const T& item2 = *reinterpret_cast<const T*>(pitem2);
+
+        if (item1 < item2)
+            return -1;
+        else if (item2 < item1)
+            return 1;
+        else
+            return 0;
+    }
+};
+
+}  // namespace wxPrivate
+
+
+
+template<typename T>
+void wxVectorSort(wxVector<T>& v)
+{
+    wxQsort(v.begin(), v.size(), sizeof(T),
+            wxPrivate::wxVectorComparator<T>::Compare, NULL);
+}
+
+
+
+#endif // wxUSE_STD_CONTAINERS/!wxUSE_STD_CONTAINERS

 
 #if WXWIN_COMPATIBILITY_2_8
     #define WX_DECLARE_VECTORBASE(obj, cls) typedef wxVector<obj> cls
 
 #if WXWIN_COMPATIBILITY_2_8
     #define WX_DECLARE_VECTORBASE(obj, cls) typedef wxVector<obj> cls