From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Sat, 30 Jul 2011 23:38:43 +0000 (+0000)
Subject: Fix crash in wxArray::insert() overload taking iterator range.
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/9c5c5c9cfd18dbad30de0b703659c1b81a155a65

Fix crash in wxArray::insert() overload taking iterator range.

The iterator passed as argument could be invalidated by the function itself,
update it before using it.

Closes #13371.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@68468 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/docs/changes.txt b/docs/changes.txt
index 8187f093a6..0d0b99255f 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -440,6 +440,7 @@ Major new features in this release
 All:
 
 - Fix parsing of negated long options in wxCmdLineParser (roed_bis).
+- Fix crash in wxArray::insert() overload taking iterator range (wsu).
 
 All (GUI):
 
diff --git a/src/common/dynarray.cpp b/src/common/dynarray.cpp
index 86a106d556..175fa4a36e 100644
--- a/src/common/dynarray.cpp
+++ b/src/common/dynarray.cpp
@@ -358,6 +358,9 @@ void name::insert(iterator it, const_iterator first, const_iterator last)   \
       return;                                                               \
   Grow(nInsert);                                                            \
                                                                             \
+  /* old iterator could have been invalidated by Grow(). */                 \
+  it = begin() + nInsert;                                                   \
+                                                                            \
   memmove(&m_pItems[nIndex + nInsert], &m_pItems[nIndex],                   \
           (m_nCount - nIndex)*sizeof(T));                                   \
   for (size_t i = 0; i < nInsert; ++i, ++it, ++first)                       \