fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / numformatter.cpp

diff --git a/src/common/numformatter.cpp b/src/common/numformatter.cpp
index 7b110abc18f840943e729600efb2426a33331b2b..0c3a6a7a1ab6c5a1ea635fead91c94e870bbdc86 100644 (file)
--- a/src/common/numformatter.cpp
+++ b/src/common/numformatter.cpp
@@ -21,9 +21,7 @@
 #include "wx/numformatter.h"
 #include "wx/intl.h"
 
-#if !wxUSE_STD_STRING
-    #include <locale.h> // for setlocale and LC_ALL
-#endif
+#include <locale.h> // for setlocale and LC_ALL
 
 // ----------------------------------------------------------------------------
 // local helpers
@@ -237,6 +235,10 @@ void wxNumberFormatter::AddThousandsSeparators(wxString& s)
         pos = s.length();
     }
 
+    // End grouping at the beginning of the digits -- there could be at a sign
+    // before their start.
+    const size_t start = s.find_first_of("0123456789");
+
     // We currently group digits by 3 independently of the locale. This is not
     // the right thing to do and we should use lconv::grouping (under POSIX)
     // and GetLocaleInfo(LOCALE_SGROUPING) (under MSW) to get information about
@@ -244,7 +246,7 @@ void wxNumberFormatter::AddThousandsSeparators(wxString& s)
     // wxLocale level first and then used here in the future (TODO).
     const size_t GROUP_LEN = 3;
 
-    while ( pos > GROUP_LEN )
+    while ( pos > start + GROUP_LEN )
     {
         pos -= GROUP_LEN;
         s.insert(pos, thousandsSep);