fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / include / wx / buffer.h

diff --git a/include/wx/buffer.h b/include/wx/buffer.h
index 9dc93398294eda9692bef7a492b051c0cc6363f1..951777a13c47fd9fe74544ebf843056fde0c812c 100644 (file)
--- a/include/wx/buffer.h
+++ b/include/wx/buffer.h
@@ -15,9 +15,7 @@
 #include "wx/chartype.h"
 #include "wx/wxcrtbase.h"
 
-#ifndef __WXPALMOS5__
 #include <stdlib.h>             // malloc() and free()
-#endif // ! __WXPALMOS5__
 
 class WXDLLIMPEXP_FWD_BASE wxCStrData;
 
@@ -56,12 +54,8 @@ struct UntypedBufferData
     bool m_owned;
 };
 
-// this has to be defined inside the DLL (and not e.g. as a static variable
-// inside an inline function) as otherwise MSVC gives link errors when the
-// functions are effectively inlined (i.e. in non-debug build)
-//
 // NB: this is defined in string.cpp and not the (non-existent) buffer.cpp
-extern WXDLLIMPEXP_DATA_BASE(UntypedBufferData * const) untypedNullDataPtr;
+WXDLLIMPEXP_BASE UntypedBufferData * GetUntypedNullData();
 
 } // namespace wxPrivate
 
@@ -99,7 +93,7 @@ public:
     // Creates "owned" buffer, i.e. takes over ownership of 'str' and frees it
     // in dtor (if ref.count reaches 0).
     static
-    const wxScopedCharTypeBuffer CreateOwned(const CharType *str,
+    const wxScopedCharTypeBuffer CreateOwned(CharType *str,
                                              size_t len = wxNO_LEN )
     {
         if ( len == wxNO_LEN )
@@ -107,7 +101,7 @@ public:
 
         wxScopedCharTypeBuffer buf;
         if ( str )
-            buf.m_data = new Data(StrCopy(str, len), len);
+            buf.m_data = new Data(str, len);
         return buf;
     }
 
@@ -142,8 +136,8 @@ public:
         if ( m_data == GetNullData() )
             return NULL;
 
-        wxASSERT_MSG( m_data->m_owned, _T("can't release non-owned buffer") );
-        wxASSERT_MSG( m_data->m_ref == 1, _T("can't release shared buffer") );
+        wxASSERT_MSG( m_data->m_owned, wxT("can't release non-owned buffer") );
+        wxASSERT_MSG( m_data->m_ref == 1, wxT("can't release shared buffer") );
 
         CharType * const p = m_data->Get();
 
@@ -186,7 +180,7 @@ protected:
     // placeholder for NULL string, to simplify this code
     static Data *GetNullData()
     {
-        return static_cast<Data *>(wxPrivate::untypedNullDataPtr);
+        return static_cast<Data *>(wxPrivate::GetUntypedNullData());
     }
 
     void IncRef()
@@ -236,7 +230,8 @@ protected:
     static CharType *StrCopy(const CharType *src, size_t len)
     {
         CharType *dst = (CharType*)malloc(sizeof(CharType) * (len + 1));
-        memcpy(dst, src, sizeof(CharType) * (len + 1));
+        if ( dst )
+            memcpy(dst, src, sizeof(CharType) * (len + 1));
         return dst;
     }
 
@@ -264,7 +259,7 @@ public:
         {
             if ( len == wxNO_LEN )
                 len = wxStrlen(str);
-            this->m_data = new Data(StrCopy(str, len), len);
+            this->m_data = new Data(this->StrCopy(str, len), len);
         }
         else
         {
@@ -299,7 +294,7 @@ public:
 
     wxCharTypeBuffer(const wxScopedCharTypeBuffer<T>& src)
     {
-        MakeOwnedCopyOf(src);
+        this->MakeOwnedCopyOf(src);
     }
 
     wxCharTypeBuffer& operator=(const wxScopedCharTypeBuffer<T>& src)
@@ -318,6 +313,10 @@ public:
         if ( !str )
             return false;
 
+        // For consistency with the ctor taking just the length, NUL-terminate
+        // the buffer.
+        str[len] = (CharType)0;
+
         if ( this->m_data == this->GetNullData() )
         {
             this->m_data = new Data(str, len);
@@ -343,6 +342,7 @@ public:
     }
 };
 
+WXDLLIMPEXP_TEMPLATE_INSTANCE_BASE( wxScopedCharTypeBuffer<char> )
 WXDLLIMPEXP_TEMPLATE_INSTANCE_BASE( wxCharTypeBuffer<char> )
 
 class wxCharBuffer : public wxCharTypeBuffer<char>
@@ -362,7 +362,7 @@ public:
     wxCharBuffer(const wxCStrData& cstr);
 };
 
-#if wxUSE_WCHAR_T
+WXDLLIMPEXP_TEMPLATE_INSTANCE_BASE( wxScopedCharTypeBuffer<wchar_t> )
 WXDLLIMPEXP_TEMPLATE_INSTANCE_BASE( wxCharTypeBuffer<wchar_t> )
 
 class wxWCharBuffer : public wxCharTypeBuffer<wchar_t>
@@ -381,7 +381,6 @@ public:
 
     wxWCharBuffer(const wxCStrData& cstr);
 };
-#endif // wxUSE_WCHAR_T
 
 // wxCharTypeBuffer<T> implicitly convertible to T*
 template <typename T>
@@ -440,7 +439,7 @@ public:
 
     friend class wxMemoryBuffer;
 
-    // everyting is private as it can only be used by wxMemoryBuffer
+    // everything is private as it can only be used by wxMemoryBuffer
 private:
     wxMemoryBufferData(size_t size = wxMemoryBufferData::DefBufSize)
         : m_data(size ? malloc(size) : NULL), m_size(size), m_len(0), m_ref(0)
@@ -472,6 +471,21 @@ private:
             delete this;
     }
 
+    void *release()
+    {
+        if ( m_data == NULL )
+            return NULL;
+
+        wxASSERT_MSG( m_ref == 1, "can't release shared buffer" );
+
+        void *p = m_data;
+        m_data = NULL;
+        m_len =
+        m_size = 0;
+
+        return p;
+    }
+
 
     // the buffer containing the data
     void  *m_data;
@@ -526,6 +540,8 @@ public:
     size_t GetBufSize() const { return m_bufdata->m_size; }
     size_t GetDataLen() const { return m_bufdata->m_len; }
 
+    bool IsEmpty() const { return GetDataLen() == 0; }
+
     void   SetBufSize(size_t size) { m_bufdata->ResizeIfNeeded(size); }
     void   SetDataLen(size_t len)
     {
@@ -533,6 +549,8 @@ public:
         m_bufdata->m_len = len;
     }
 
+    void Clear() { SetDataLen(0); }
+
     // Ensure the buffer is big enough and return a pointer to it
     void *GetWriteBuf(size_t sizeNeeded)
     {
@@ -559,7 +577,7 @@ public:
     // Other ways to append to the buffer
     void  AppendByte(char data)
     {
-        wxCHECK_RET( m_bufdata->m_data, _T("invalid wxMemoryBuffer") );
+        wxCHECK_RET( m_bufdata->m_data, wxT("invalid wxMemoryBuffer") );
 
         m_bufdata->ResizeIfNeeded(m_bufdata->m_len + 1);
         *(((char*)m_bufdata->m_data) + m_bufdata->m_len) = data;
@@ -574,6 +592,13 @@ public:
 
     operator const char *() const { return (const char*)GetData(); }
 
+    // gives up ownership of data, returns the pointer; after this call,
+    // data isn't freed by the buffer and its content is resent to empty
+    void *release()
+    {
+        return m_bufdata->release();
+    }
+
 private:
     wxMemoryBufferData*  m_bufdata;
 };