fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / dcbufcmn.cpp

diff --git a/src/common/dcbufcmn.cpp b/src/common/dcbufcmn.cpp
index b38b4f1f67921c65093f3bcbc69c3517a42b30e8..d625c72f8fd288e7928d9cb1e5275410928b3619 100644 (file)
--- a/src/common/dcbufcmn.cpp
+++ b/src/common/dcbufcmn.cpp
@@ -34,6 +34,9 @@
 // implementation
 // ============================================================================
 
+IMPLEMENT_DYNAMIC_CLASS(wxBufferedDC,wxMemoryDC)
+IMPLEMENT_ABSTRACT_CLASS(wxBufferedPaintDC,wxBufferedDC)
+
 // ----------------------------------------------------------------------------
 // wxSharedDCBufferManager: helper class maintaining backing store bitmap
 // ----------------------------------------------------------------------------
@@ -56,6 +59,14 @@ public:
                     h > ms_buffer->GetHeight() )
         {
             delete ms_buffer;
+
+            // we must always return a valid bitmap but creating a bitmap of
+            // size 0 would fail, so create a 1*1 bitmap in this case
+            if ( !w )
+                w = 1;
+            if ( !h )
+                h = 1;
+
             ms_buffer = new wxBitmap(w, h);
         }
 
@@ -94,6 +105,8 @@ IMPLEMENT_DYNAMIC_CLASS(wxSharedDCBufferManager, wxModule)
 
 void wxBufferedDC::UseBuffer(wxCoord w, wxCoord h)
 {
+    wxCHECK_RET( w >= -1 && h >= -1, "Invalid buffer size" );
+
     if ( !m_buffer || !m_buffer->IsOk() )
     {
         if ( w == -1 || h == -1 )
@@ -101,24 +114,51 @@ void wxBufferedDC::UseBuffer(wxCoord w, wxCoord h)
 
         m_buffer = wxSharedDCBufferManager::GetBuffer(w, h);
         m_style |= wxBUFFER_USES_SHARED_BUFFER;
+        m_area.Set(w,h);
     }
+    else
+        m_area = m_buffer->GetSize();
 
     SelectObject(*m_buffer);
+
+    // now that the DC is valid we can inherit the attributes (fonts, colours,
+    // layout direction, ...) from the original DC
+    if ( m_dc && m_dc->IsOk() )
+        CopyAttributes(*m_dc);
 }
 
 void wxBufferedDC::UnMask()
 {
-    wxCHECK_RET( m_dc, _T("no underlying wxDC?") );
-    wxASSERT_MSG( m_buffer && m_buffer->IsOk(), _T("invalid backing store") );
+    wxCHECK_RET( m_dc, wxT("no underlying wxDC?") );
+    wxASSERT_MSG( m_buffer && m_buffer->IsOk(), wxT("invalid backing store") );
 
     wxCoord x = 0,
             y = 0;
 
+    // Ensure the scale matches the device
+    SetUserScale(1.0, 1.0);
+
     if ( m_style & wxBUFFER_CLIENT_AREA )
         GetDeviceOrigin(&x, &y);
 
-    m_dc->Blit(0, 0, m_buffer->GetWidth(), m_buffer->GetHeight(),
-               this, -x, -y );
+    // It's possible that the buffer may be bigger than the area that needs to
+    // be drawn (the client size of the window is smaller than the bitmap, or
+    // a shared bitmap has been reused for a smaller area, etc.) so avoid
+    // blitting too much if possible, but only use the real DC size if the
+    // wxBUFFER_VIRTUAL_AREA style is not set.
+    int width = m_area.GetWidth(),
+        height = m_area.GetHeight();
+
+    if (! m_style & wxBUFFER_VIRTUAL_AREA)
+    {
+        int widthDC,
+            heightDC;
+        m_dc->GetSize(&widthDC, &heightDC);
+        width = wxMin(width, widthDC);
+        height = wxMin(height, heightDC);
+    }
+
+    m_dc->Blit(0, 0, width, height, this, -x, -y);
     m_dc = NULL;
 
     if ( m_style & wxBUFFER_USES_SHARED_BUFFER )