fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / ctrlsub.cpp

diff --git a/src/common/ctrlsub.cpp b/src/common/ctrlsub.cpp
index ec05cae1468d69a61287c0c09a030dc41e51693b..388af3e6ffb77501e18589e4ae79c5aed5418838 100644 (file)
--- a/src/common/ctrlsub.cpp
+++ b/src/common/ctrlsub.cpp
@@ -102,14 +102,14 @@ void wxItemContainer::Clear()
             ResetItemClientObject(i);
     }
 
-    m_clientDataItemsType = wxClientData_None;
+    SetClientDataType(wxClientData_None);
 
     DoClear();
 }
 
 void wxItemContainer::Delete(unsigned int pos)
 {
-    wxCHECK_RET( pos < GetCount(), _T("invalid index") );
+    wxCHECK_RET( pos < GetCount(), wxT("invalid index") );
 
     if ( HasClientObjectData() )
         ResetItemClientObject(pos);
@@ -118,12 +118,12 @@ void wxItemContainer::Delete(unsigned int pos)
 
     if ( IsEmpty() )
     {
-        m_clientDataItemsType = wxClientData_None;
+        SetClientDataType(wxClientData_None);
     }
 }
 
 // ----------------------------------------------------------------------------
-// 
+//
 // ----------------------------------------------------------------------------
 
 int wxItemContainer::DoInsertItemsInLoop(const wxArrayStringsAdapter& items,
@@ -150,7 +150,7 @@ int
 wxItemContainer::DoInsertOneItem(const wxString& WXUNUSED(item),
                                  unsigned int WXUNUSED(pos))
 {
-    wxFAIL_MSG( _T("Must be overridden if DoInsertItemsInLoop() is used") );
+    wxFAIL_MSG( wxT("Must be overridden if DoInsertItemsInLoop() is used") );
 
     return wxNOT_FOUND;
 }
@@ -162,23 +162,24 @@ wxItemContainer::DoInsertOneItem(const wxString& WXUNUSED(item),
 
 void wxItemContainer::SetClientObject(unsigned int n, wxClientData *data)
 {
-    wxASSERT_MSG( m_clientDataItemsType == wxClientData_Object ||
-                    m_clientDataItemsType == wxClientData_None,
+    wxASSERT_MSG( !HasClientUntypedData(),
                   wxT("can't have both object and void client data") );
 
-    if ( m_clientDataItemsType == wxClientData_Object )
+    wxCHECK_RET( IsValid(n), "Invalid index passed to SetClientObject()" );
+
+    if ( HasClientObjectData() )
     {
         wxClientData * clientDataOld
-            = wx_static_cast(wxClientData *, DoGetItemClientData(n));
+            = static_cast<wxClientData *>(DoGetItemClientData(n));
         if ( clientDataOld )
             delete clientDataOld;
     }
-    else // m_clientDataItemsType == wxClientData_None
+    else // didn't have any client data so far
     {
         // now we have object client data
         DoInitItemClientData();
 
-        m_clientDataItemsType = wxClientData_Object;
+        SetClientDataType(wxClientData_Object);
     }
 
     DoSetItemClientData(n, data);
@@ -186,31 +187,51 @@ void wxItemContainer::SetClientObject(unsigned int n, wxClientData *data)
 
 wxClientData *wxItemContainer::GetClientObject(unsigned int n) const
 {
-    wxCHECK_MSG( m_clientDataItemsType == wxClientData_Object, NULL,
+    wxCHECK_MSG( HasClientObjectData(), NULL,
                   wxT("this window doesn't have object client data") );
 
-    return wx_static_cast(wxClientData *, DoGetItemClientData(n));
+    wxCHECK_MSG( IsValid(n), NULL,
+                 "Invalid index passed to GetClientObject()" );
+
+    return static_cast<wxClientData *>(DoGetItemClientData(n));
+}
+
+wxClientData *wxItemContainer::DetachClientObject(unsigned int n)
+{
+    wxClientData * const data = GetClientObject(n);
+    if ( data )
+    {
+        // reset the pointer as we don't own it any more
+        DoSetItemClientData(n, NULL);
+    }
+
+    return data;
 }
 
 void wxItemContainer::SetClientData(unsigned int n, void *data)
 {
-    if ( m_clientDataItemsType == wxClientData_None )
+    if ( !HasClientData() )
     {
         DoInitItemClientData();
-        m_clientDataItemsType = wxClientData_Void;
+        SetClientDataType(wxClientData_Void);
     }
 
-    wxASSERT_MSG( m_clientDataItemsType == wxClientData_Void,
+    wxASSERT_MSG( HasClientUntypedData(),
                   wxT("can't have both object and void client data") );
 
+    wxCHECK_RET( IsValid(n), "Invalid index passed to SetClientData()" );
+
     DoSetItemClientData(n, data);
 }
 
 void *wxItemContainer::GetClientData(unsigned int n) const
 {
-    wxCHECK_MSG( m_clientDataItemsType == wxClientData_Void, NULL,
+    wxCHECK_MSG( HasClientUntypedData(), NULL,
                   wxT("this window doesn't have void client data") );
 
+    wxCHECK_MSG( IsValid(n), NULL,
+                 "Invalid index passed to GetClientData()" );
+
     return DoGetItemClientData(n);
 }
 
@@ -225,7 +246,7 @@ void wxItemContainer::AssignNewItemClientData(unsigned int pos,
             SetClientObject
             (
                 pos,
-                (wx_reinterpret_cast(wxClientData **, clientData))[n]
+                (reinterpret_cast<wxClientData **>(clientData))[n]
             );
             break;
 
@@ -234,7 +255,7 @@ void wxItemContainer::AssignNewItemClientData(unsigned int pos,
             break;
 
         default:
-            wxFAIL_MSG( _T("unknown client data type") );
+            wxFAIL_MSG( wxT("unknown client data type") );
             // fall through
 
         case wxClientData_None: