From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Sun, 7 Jul 2013 00:38:41 +0000 (+0000)
Subject: Avoid using buffer of already deallocated string in wxHTMLDataObject.
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/8472511246c9160d4ff40ab86f635fc67c10b54a

Avoid using buffer of already deallocated string in wxHTMLDataObject.

Ensure that the temporary string inside which the pointer returned by
utf8_str() may point remains alive for long enough.

Closes #15279.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@74429 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/src/common/dobjcmn.cpp b/src/common/dobjcmn.cpp
index 7925041420..3486edefb9 100644
--- a/src/common/dobjcmn.cpp
+++ b/src/common/dobjcmn.cpp
@@ -448,7 +448,10 @@ bool wxTextDataObject::SetData(size_t len, const void *buf)
 
 size_t wxHTMLDataObject::GetDataSize() const
 {
-    const wxScopedCharBuffer buffer(GetHTML().utf8_str());
+    // Ensure that the temporary string returned by GetHTML() is kept alive for
+    // as long as we need it here.
+    const wxString& htmlStr = GetHTML();
+    const wxScopedCharBuffer buffer(htmlStr.utf8_str());
 
     size_t size = buffer.length();
 
@@ -467,7 +470,8 @@ bool wxHTMLDataObject::GetDataHere(void *buf) const
         return false;
 
     // Windows and Mac always use UTF-8, and docs suggest GTK does as well.
-    const wxScopedCharBuffer html(GetHTML().utf8_str());
+    const wxString& htmlStr = GetHTML();
+    const wxScopedCharBuffer html(htmlStr.utf8_str());
     if ( !html )
         return false;