fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / dcbufcmn.cpp

diff --git a/src/common/dcbufcmn.cpp b/src/common/dcbufcmn.cpp
index fe807524121e2f394b7c9276dca28012c5dd5b5a..d625c72f8fd288e7928d9cb1e5275410928b3619 100644 (file)
--- a/src/common/dcbufcmn.cpp
+++ b/src/common/dcbufcmn.cpp
@@ -24,113 +24,143 @@
     #pragma hdrstop
 #endif
 
     #pragma hdrstop
 #endif
 

-#ifndef WX_PRECOMP
-#endif
-

 #include "wx/dcbuffer.h"
 
 #include "wx/dcbuffer.h"
 

+#ifndef WX_PRECOMP
+    #include "wx/module.h"
+#endif

 
 // ============================================================================
 // implementation
 // ============================================================================
 
 
 // ============================================================================
 // implementation
 // ============================================================================
 

-// ============================================================================
-// wxSharedDCBufferManager
-//   Helper class to free shared buffer when the app exists.
-// ============================================================================
+IMPLEMENT_DYNAMIC_CLASS(wxBufferedDC,wxMemoryDC)
+IMPLEMENT_ABSTRACT_CLASS(wxBufferedPaintDC,wxBufferedDC)

 
 

-class wxSharedDCBufferManager
+// ----------------------------------------------------------------------------
+// wxSharedDCBufferManager: helper class maintaining backing store bitmap
+// ----------------------------------------------------------------------------
+
+class wxSharedDCBufferManager : public wxModule

 {
 {

-    friend class wxBufferedDC;

 public:
 public:

+    wxSharedDCBufferManager() { }

 
 

-    wxSharedDCBufferManager()
-    {
-        m_buffer = NULL;
-    }
+    virtual bool OnInit() { return true; }
+    virtual void OnExit() { wxDELETE(ms_buffer); }

 
 

-    ~wxSharedDCBufferManager()
+    static wxBitmap* GetBuffer(int w, int h)

     {
     {

-        delete m_buffer;
-    }
-
-    wxBitmap* GetBuffer(wxWindow* win, const wxSize& area)
-    {
-        int width = area.x;
-        int height = area.y;
-
-        if ( width <= 0 )
-            win->GetClientSize(&width, &height);
+        if ( ms_usingSharedBuffer )
+            return new wxBitmap(w, h);

 
 

-        if ( !m_buffer ||
-             width > m_buffer->GetWidth() ||
-             height > m_buffer->GetHeight() )
+        if ( !ms_buffer ||
+                w > ms_buffer->GetWidth() ||
+                    h > ms_buffer->GetHeight() )

         {
         {

-            delete m_buffer;
+            delete ms_buffer;

 
 

-            // Create slightly larger bitmap so we don't need to
-            // be reallocating constantly when the user enlarges
-            // the frame for the first time.
-            m_buffer = new wxBitmap(width+20, height+20);
+            // we must always return a valid bitmap but creating a bitmap of
+            // size 0 would fail, so create a 1*1 bitmap in this case
+            if ( !w )
+                w = 1;
+            if ( !h )
+                h = 1;
+
+            ms_buffer = new wxBitmap(w, h);

         }
 
         }
 

-        return m_buffer;
+        ms_usingSharedBuffer = true;
+        return ms_buffer;
+    }
+
+    static void ReleaseBuffer(wxBitmap* buffer)
+    {
+        if ( buffer == ms_buffer )
+        {
+            wxASSERT_MSG( ms_usingSharedBuffer, wxT("shared buffer already released") );
+            ms_usingSharedBuffer = false;
+        }
+        else
+        {
+            delete buffer;
+        }

     }
 
 private:
     }
 
 private:

-    wxBitmap*   m_buffer;
+    static wxBitmap *ms_buffer;
+    static bool ms_usingSharedBuffer;
+
+    DECLARE_DYNAMIC_CLASS(wxSharedDCBufferManager)

 };
 
 };
 

-static wxSharedDCBufferManager gs_sharedDCBufferManager;
+wxBitmap* wxSharedDCBufferManager::ms_buffer = NULL;
+bool wxSharedDCBufferManager::ms_usingSharedBuffer = false;
+
+IMPLEMENT_DYNAMIC_CLASS(wxSharedDCBufferManager, wxModule)

 
 // ============================================================================
 // wxBufferedDC
 // ============================================================================
 
 
 // ============================================================================
 // wxBufferedDC
 // ============================================================================
 

-// Blits the buffer to the dc, and detaches the dc from the buffer (so it
-// can be effectively used once only).
-//
-// Usually called in the dtor or by the dtor of derived classes if the
-// BufferedDC must blit before the derived class (which may own the dc it's
-// blitting to) is destroyed.
-void wxBufferedDC::UnMask()
+void wxBufferedDC::UseBuffer(wxCoord w, wxCoord h)

 {
 {

-    if ( m_buffer )
-    {
-        wxASSERT_MSG( m_mainDc != NULL,
-                      _T("No underlying DC associated with wxBufferedDC (anymore)") );
-
-        wxDC* bufferDc = DetachDC();
+    wxCHECK_RET( w >= -1 && h >= -1, "Invalid buffer size" );

 
 

-        wxASSERT( bufferDc->IsKindOf(CLASSINFO(wxMemoryDC)) );
+    if ( !m_buffer || !m_buffer->IsOk() )
+    {
+        if ( w == -1 || h == -1 )
+            m_dc->GetSize(&w, &h);

 
 

-        wxCoord x=0, y=0;
+        m_buffer = wxSharedDCBufferManager::GetBuffer(w, h);
+        m_style |= wxBUFFER_USES_SHARED_BUFFER;
+        m_area.Set(w,h);
+    }
+    else
+        m_area = m_buffer->GetSize();

 
 

-        if (m_style & wxBUFFER_CLIENT_AREA)
-            bufferDc->GetDeviceOrigin(& x, & y);
+    SelectObject(*m_buffer);

 
 

-        m_mainDc->Blit( 0, 0,
-                        m_buffer->GetWidth(), m_buffer->GetHeight(), bufferDc,
-                        -x, -y );
-        m_mainDc = NULL;
-        m_buffer = NULL;
-        delete bufferDc;
-    }
+    // now that the DC is valid we can inherit the attributes (fonts, colours,
+    // layout direction, ...) from the original DC
+    if ( m_dc && m_dc->IsOk() )
+        CopyAttributes(*m_dc);

 }
 
 }
 

-void wxBufferedDC::PrepareBuffer(wxWindow* win, const wxSize& area)
+void wxBufferedDC::UnMask()

 {
 {

-    m_buffer = gs_sharedDCBufferManager.GetBuffer(win, area);
-}
+    wxCHECK_RET( m_dc, wxT("no underlying wxDC?") );
+    wxASSERT_MSG( m_buffer && m_buffer->IsOk(), wxT("invalid backing store") );

 
 

-void wxBufferedDC::UseBuffer()
-{
-    wxASSERT(m_buffer);
+    wxCoord x = 0,
+            y = 0;

 
 

-    wxMemoryDC* memoryDc = new wxMemoryDC(m_mainDc);
-    memoryDc->SelectObject(*m_buffer);
+    // Ensure the scale matches the device
+    SetUserScale(1.0, 1.0);

 
 

-    AttachDC(memoryDc);
-}
+    if ( m_style & wxBUFFER_CLIENT_AREA )
+        GetDeviceOrigin(&x, &y);

 
 

+    // It's possible that the buffer may be bigger than the area that needs to
+    // be drawn (the client size of the window is smaller than the bitmap, or
+    // a shared bitmap has been reused for a smaller area, etc.) so avoid
+    // blitting too much if possible, but only use the real DC size if the
+    // wxBUFFER_VIRTUAL_AREA style is not set.
+    int width = m_area.GetWidth(),
+        height = m_area.GetHeight();

 
 

+    if (! m_style & wxBUFFER_VIRTUAL_AREA)
+    {
+        int widthDC,
+            heightDC;
+        m_dc->GetSize(&widthDC, &heightDC);
+        width = wxMin(width, widthDC);
+        height = wxMin(height, heightDC);
+    }
+
+    m_dc->Blit(0, 0, width, height, this, -x, -y);
+    m_dc = NULL;
+
+    if ( m_style & wxBUFFER_USES_SHARED_BUFFER )
+        wxSharedDCBufferManager::ReleaseBuffer(m_buffer);
+}