fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / stringimpl.cpp

diff --git a/src/common/stringimpl.cpp b/src/common/stringimpl.cpp
index ed9a83e476e14e4c406cabe32eca5aba2efa94c9..498793722e8f171a109b642db979fbcc0ff57ec6 100644 (file)
--- a/src/common/stringimpl.cpp
+++ b/src/common/stringimpl.cpp
@@ -681,7 +681,11 @@ bool wxStringImpl::AssignCopy(size_t nSrcLen,
       // allocation failure handled by caller
       return false;
     }
-    memcpy(m_pchData, pszSrcData, nSrcLen*sizeof(wxStringCharType));
+
+    // use memmove() and not memcpy() here as we might be copying from our own
+    // buffer in case of assignment such as "s = s.c_str()" (see #11294)
+    memmove(m_pchData, pszSrcData, nSrcLen*sizeof(wxStringCharType));
+
     GetStringData()->nDataLength = nSrcLen;
     m_pchData[nSrcLen] = wxT('\0');
   }