fixed a rare crash due to malformed HTML

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@34870 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/docs/changes.txt b/docs/changes.txt
index fa82b4feafcf6365fcf4e718dbd71ea07ec04a1a..68b8f1f0af6071cac882e527c0a713929c1c4f9c 100644 (file)
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -14,6 +14,7 @@ All (GUI):
 
 - Added wxXmlResource::Unload()
 - Possibility of modeless wxWizard dialog (with presentation in sample).
 
 - Added wxXmlResource::Unload()
 - Possibility of modeless wxWizard dialog (with presentation in sample).

+- Fixed a rare crash due to malformed HTML in wxHTML (Xavier Nodet)

 
 wxMSW:
 
 
 wxMSW:
 

diff --git a/src/html/htmltag.cpp b/src/html/htmltag.cpp
index f5e93ffa033914e5fe09e94cf0d7f6f554d29b3f..014945054366c5fb6229d6dec1e34709b1ca8df5 100644 (file)
--- a/src/html/htmltag.cpp
+++ b/src/html/htmltag.cpp
@@ -194,6 +194,16 @@ void wxHtmlTagsCache::QueryTag(int at, int* end1, int* end2)
         int delta = (at < m_Cache[m_CachePos].Key) ? -1 : 1;
         do
         {
         int delta = (at < m_Cache[m_CachePos].Key) ? -1 : 1;
         do
         {

+            if ( m_CachePos < 0 || m_CachePos == m_CacheSize )
+            {
+                // something is very wrong with HTML, give up by returning an
+                // impossibly large value which is going to be ignored by the
+                // caller
+                *end1 =
+                *end2 = INT_MAX;
+                return;
+            }
+

             m_CachePos += delta;
         }
         while (m_Cache[m_CachePos].Key != at);
             m_CachePos += delta;
         }
         while (m_Cache[m_CachePos].Key != at);