fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / wxprintf.cpp

diff --git a/src/common/wxprintf.cpp b/src/common/wxprintf.cpp
index fada74e4965ff25d5d3aac370ebd4fa1e2bc834c..87d7deba3350f4078b8a2152f30df51f8b34996b 100644 (file)
--- a/src/common/wxprintf.cpp
+++ b/src/common/wxprintf.cpp
@@ -142,9 +142,16 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
     const CharType *toparse = format;
     for (i=0; i < parser.nargs; i++)
     {
+        wxPrintfConvSpec<CharType>& spec = parser.specs[i];
+
+        // skip any asterisks, they're processed as part of the conversion they
+        // apply to
+        if ( spec.m_type == wxPAT_STAR )
+            continue;
+
         // copy in the output buffer the portion of the format string between
         // last specifier and the current one
-        size_t tocopy = ( parser.arg[i].m_pArgPos - toparse );
+        size_t tocopy = ( spec.m_pArgPos - toparse );
 
         lenCur += wxCopyStrWithPercents(lenMax - lenCur, buf + lenCur,
                                         tocopy, toparse);
@@ -155,8 +162,8 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
         }
 
         // process this specifier directly in the output buffer
-        int n = parser.arg[i].Process(buf+lenCur, lenMax - lenCur,
-                                      &argdata[parser.arg[i].m_pos], lenCur);
+        int n = spec.Process(buf+lenCur, lenMax - lenCur,
+                                      &argdata[spec.m_pos], lenCur);
         if (n == -1)
         {
             buf[lenMax-1] = wxT('\0');  // be sure to always NUL-terminate the string
@@ -166,7 +173,7 @@ static int wxDoVsnprintf(CharType *buf, size_t lenMax,
 
         // the +1 is because wxPrintfConvSpec::m_pArgEnd points to the last character
         // of the format specifier, but we are not interested to it...
-        toparse = parser.arg[i].m_pArgEnd + 1;
+        toparse = spec.m_pArgEnd + 1;
     }
 
     // copy portion of the format string after last specifier