fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / dcbufcmn.cpp

diff --git a/src/common/dcbufcmn.cpp b/src/common/dcbufcmn.cpp
index 2e3d79240096cad1da4fe03a8316cd8cff5ac7c4..d625c72f8fd288e7928d9cb1e5275410928b3619 100644 (file)
--- a/src/common/dcbufcmn.cpp
+++ b/src/common/dcbufcmn.cpp
@@ -105,6 +105,8 @@ IMPLEMENT_DYNAMIC_CLASS(wxSharedDCBufferManager, wxModule)
 
 void wxBufferedDC::UseBuffer(wxCoord w, wxCoord h)
 {
+    wxCHECK_RET( w >= -1 && h >= -1, "Invalid buffer size" );
+
     if ( !m_buffer || !m_buffer->IsOk() )
     {
         if ( w == -1 || h == -1 )
@@ -112,7 +114,10 @@ void wxBufferedDC::UseBuffer(wxCoord w, wxCoord h)
 
         m_buffer = wxSharedDCBufferManager::GetBuffer(w, h);
         m_style |= wxBUFFER_USES_SHARED_BUFFER;
+        m_area.Set(w,h);
     }
+    else
+        m_area = m_buffer->GetSize();
 
     SelectObject(*m_buffer);
 
@@ -136,21 +141,24 @@ void wxBufferedDC::UnMask()
     if ( m_style & wxBUFFER_CLIENT_AREA )
         GetDeviceOrigin(&x, &y);
 
-    // avoid blitting too much: if we were created for a bigger bitmap (and
-    // reused for a smaller one later) we should only blit the real bitmap area
-    // and not the full allocated back buffer
-    int widthDC,
-        heightDC;
-
-    m_dc->GetSize(&widthDC, &heightDC);
+    // It's possible that the buffer may be bigger than the area that needs to
+    // be drawn (the client size of the window is smaller than the bitmap, or
+    // a shared bitmap has been reused for a smaller area, etc.) so avoid
+    // blitting too much if possible, but only use the real DC size if the
+    // wxBUFFER_VIRTUAL_AREA style is not set.
+    int width = m_area.GetWidth(),
+        height = m_area.GetHeight();
 
-    int widthBuf = m_buffer->GetWidth(),
-        heightBuf = m_buffer->GetHeight();
+    if (! m_style & wxBUFFER_VIRTUAL_AREA)
+    {
+        int widthDC,
+            heightDC;
+        m_dc->GetSize(&widthDC, &heightDC);
+        width = wxMin(width, widthDC);
+        height = wxMin(height, heightDC);
+    }
 
-    m_dc->Blit(0, 0,
-               wxMin(widthDC, widthBuf), wxMin(heightDC, heightBuf),
-               this,
-               -x, -y);
+    m_dc->Blit(0, 0, width, height, this, -x, -y);
     m_dc = NULL;
 
     if ( m_style & wxBUFFER_USES_SHARED_BUFFER )