From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Sat, 19 Feb 2011 00:30:32 +0000 (+0000)
Subject: Fix out of bounds string access in wxMSW wxDirDialog.
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/359cde15e07bd684c9175b51c04ab02c9ee40745

Fix out of bounds string access in wxMSW wxDirDialog.

Using the initial directory of "/" (or "\\" or in fact any string consisting
solely of slashes and backslashes) resulted in a crash as the code incorrectly
tried to read the character before the beginning of the string.

Fix this by checking that the string is not empty before using s.end()-1
iterator.

Closes #12946.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@66961 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/src/msw/dirdlg.cpp b/src/msw/dirdlg.cpp
index 1885114647..9d3b472058 100644
--- a/src/msw/dirdlg.cpp
+++ b/src/msw/dirdlg.cpp
@@ -101,19 +101,17 @@ void wxDirDialog::SetPath(const wxString& path)
 
     // SHBrowseForFolder doesn't like '/'s nor the trailing backslashes
     m_path.Replace(wxT("/"), wxT("\\"));
-    if ( !m_path.empty() )
+
+    while ( !m_path.empty() && (*(m_path.end() - 1) == wxT('\\')) )
     {
-        while ( *(m_path.end() - 1) == wxT('\\') )
-        {
-            m_path.erase(m_path.length() - 1);
-        }
+        m_path.erase(m_path.length() - 1);
+    }
 
-        // but the root drive should have a trailing slash (again, this is just
-        // the way the native dialog works)
-        if ( *(m_path.end() - 1) == wxT(':') )
-        {
-            m_path += wxT('\\');
-        }
+    // but the root drive should have a trailing slash (again, this is just
+    // the way the native dialog works)
+    if ( !m_path.empty() && (*(m_path.end() - 1) == wxT(':')) )
+    {
+        m_path += wxT('\\');
     }
 }