Add some asserts to ensure cols and rows are >= 0 to avoid crashes

[wxWidgets.git] / src / common / wxprintf.cpp

diff --git a/src/common/wxprintf.cpp b/src/common/wxprintf.cpp
index f0c4c221b99eb8b84c13b067265e2c20e8d220f7..87d7deba3350f4078b8a2152f30df51f8b34996b 100644 (file)
--- a/src/common/wxprintf.cpp
+++ b/src/common/wxprintf.cpp
@@ -139,12 +139,19 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
     }
 
     // finally, process each conversion specifier with its own argument
-    toparse = format;
+    const CharType *toparse = format;
     for (i=0; i < parser.nargs; i++)
     {
+        wxPrintfConvSpec<CharType>& spec = parser.specs[i];
+
+        // skip any asterisks, they're processed as part of the conversion they
+        // apply to
+        if ( spec.m_type == wxPAT_STAR )
+            continue;
+
         // copy in the output buffer the portion of the format string between
         // last specifier and the current one
-        size_t tocopy = ( arg[i].m_pArgPos - toparse );
+        size_t tocopy = ( spec.m_pArgPos - toparse );
 
         lenCur += wxCopyStrWithPercents(lenMax - lenCur, buf + lenCur,
                                         tocopy, toparse);
@@ -155,7 +162,8 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
         }
 
         // process this specifier directly in the output buffer
-        int n = arg[i].Process(buf+lenCur, lenMax - lenCur, &argdata[arg[i].m_pos], lenCur);
+        int n = spec.Process(buf+lenCur, lenMax - lenCur,
+                                      &argdata[spec.m_pos], lenCur);
         if (n == -1)
         {
             buf[lenMax-1] = wxT('\0');  // be sure to always NUL-terminate the string
@@ -165,7 +173,7 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
 
         // the +1 is because wxPrintfConvSpec::m_pArgEnd points to the last character
         // of the format specifier, but we are not interested to it...
-        toparse = arg[i].m_pArgEnd + 1;
+        toparse = spec.m_pArgEnd + 1;
     }
 
     // copy portion of the format string after last specifier
@@ -174,7 +182,7 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
     // NOTE2: the +1 is because we want to copy also the '\0'
     size_t tocopy = wxStrlen(format) + 1  - ( toparse - format ) ;
 
-    lenCur += wxCopyStrWithPercents(lenMax - lenCur, buf + lenCur, 
+    lenCur += wxCopyStrWithPercents(lenMax - lenCur, buf + lenCur,
                                     tocopy, toparse) - 1;
     if (buf[lenCur])
     {
@@ -190,8 +198,6 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
     return lenCur;
 }
 
-} // anonymous namespace
-
 #endif // !defined(wxCRT_VsnprintfW) || !defined(wxCRT_VsnprintfA)
 
 // ----------------------------------------------------------------------------