fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / numformatter.cpp

diff --git a/src/common/numformatter.cpp b/src/common/numformatter.cpp
index eb4583b52060fd723568e3404ec79b31bf11c427..0c3a6a7a1ab6c5a1ea635fead91c94e870bbdc86 100644 (file)
--- a/src/common/numformatter.cpp
+++ b/src/common/numformatter.cpp
@@ -235,6 +235,10 @@ void wxNumberFormatter::AddThousandsSeparators(wxString& s)
         pos = s.length();
     }
 
         pos = s.length();
     }
 

+    // End grouping at the beginning of the digits -- there could be at a sign
+    // before their start.
+    const size_t start = s.find_first_of("0123456789");
+

     // We currently group digits by 3 independently of the locale. This is not
     // the right thing to do and we should use lconv::grouping (under POSIX)
     // and GetLocaleInfo(LOCALE_SGROUPING) (under MSW) to get information about
     // We currently group digits by 3 independently of the locale. This is not
     // the right thing to do and we should use lconv::grouping (under POSIX)
     // and GetLocaleInfo(LOCALE_SGROUPING) (under MSW) to get information about


@@ -242,7 +246,7 @@ void wxNumberFormatter::AddThousandsSeparators(wxString& s)
     // wxLocale level first and then used here in the future (TODO).
     const size_t GROUP_LEN = 3;
 
     // wxLocale level first and then used here in the future (TODO).
     const size_t GROUP_LEN = 3;
 

-    while ( pos > GROUP_LEN )
+    while ( pos > start + GROUP_LEN )

     {
         pos -= GROUP_LEN;
         s.insert(pos, thousandsSep);
     {
         pos -= GROUP_LEN;
         s.insert(pos, thousandsSep);