From: Stefan Csomor <csomor@advancedconcepts.ch>
Date: Fri, 23 Nov 2012 07:55:58 +0000 (+0000)
Subject: fixing overrelease and out-of-bounds write, fixes #13725
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/77c8efc8c37da6d6a5e2e8022d21d1cd7d76371d

fixing overrelease and out-of-bounds write, fixes #13725

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@72996 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/src/osx/cocoa/dataview.mm b/src/osx/cocoa/dataview.mm
index 2e195d0317..632af4b04b 100644
--- a/src/osx/cocoa/dataview.mm
+++ b/src/osx/cocoa/dataview.mm
@@ -926,7 +926,8 @@ outlineView:(NSOutlineView*)outlineView
                     size_t const dataSize       = event.GetDataObject()->GetDataSize(idDataFormat);
                     size_t const dataBufferSize = sizeof(wxDataFormatId)+dataSize;
                     // variable definitions (used in all case statements):
-                    wxMemoryBuffer dataBuffer(dataBufferSize);
+                    // give additional headroom for trailing NULL
+                    wxMemoryBuffer dataBuffer(dataBufferSize+4);
 
                     dataBuffer.AppendData(&idDataFormat,sizeof(wxDataFormatId));
                     switch (idDataFormat)
@@ -958,7 +959,6 @@ outlineView:(NSOutlineView*)outlineView
                             break;
                         default:
                             wxFAIL_MSG("Data object has invalid or unsupported data format");
-                            [dataArray release];
                             return NO;
                     }
                 }
@@ -976,7 +976,6 @@ outlineView:(NSOutlineView*)outlineView
             }
             else
             {
-                [dataArray release];
                 delete itemObject;
                 return NO; // dragging was vetoed or no data available
             }