Fix crash in wxArray::insert() overload taking iterator range.

The iterator passed as argument could be invalidated by the function itself,
update it before using it.

Closes #13371.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@68468 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/docs/changes.txt b/docs/changes.txt
index 8187f093a644bc57df77a59eedb23d3bc3247503..0d0b99255f51f4dae33d5b9d3cbff2c594687818 100644 (file)
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -440,6 +440,7 @@ Major new features in this release
 All:
 
 - Fix parsing of negated long options in wxCmdLineParser (roed_bis).
+- Fix crash in wxArray::insert() overload taking iterator range (wsu).
 
 All (GUI):
 

diff --git a/src/common/dynarray.cpp b/src/common/dynarray.cpp
index 86a106d5568bae45cd544d0cb470ffdc5c1cd71c..175fa4a36e30522d6e5615a9b5839151009025ad 100644 (file)
--- a/src/common/dynarray.cpp
+++ b/src/common/dynarray.cpp
@@ -358,6 +358,9 @@ void name::insert(iterator it, const_iterator first, const_iterator last)   \
       return;                                                               \
   Grow(nInsert);                                                            \
                                                                             \
+  /* old iterator could have been invalidated by Grow(). */                 \
+  it = begin() + nInsert;                                                   \
+                                                                            \
   memmove(&m_pItems[nIndex + nInsert], &m_pItems[nIndex],                   \
           (m_nCount - nIndex)*sizeof(T));                                   \
   for (size_t i = 0; i < nInsert; ++i, ++it, ++first)                       \