From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Fri, 31 Mar 2006 20:23:33 +0000 (+0000)
Subject: fixed fatal buffer overwrite in wxMBConvUTF16swap::MB2WC()
X-Git-Url: https://git.saurik.com/wxWidgets.git/commitdiff_plain/bfab25d4c41327d6db170be1f832821f36cd425f

fixed fatal buffer overwrite in wxMBConvUTF16swap::MB2WC()


git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@38487 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---

diff --git a/src/common/strconv.cpp b/src/common/strconv.cpp
index e1fed4d99e..778d8dbb05 100644
--- a/src/common/strconv.cpp
+++ b/src/common/strconv.cpp
@@ -862,20 +862,22 @@ size_t wxMBConvUTF16straight::WC2MB(char *buf, const wchar_t *psz, size_t n) con
 // swap 16bit MB to 16bit String
 size_t wxMBConvUTF16swap::MB2WC(wchar_t *buf, const char *psz, size_t n) const
 {
-    size_t len=0;
+    size_t len = 0;
 
-    while (*(wxUint16*)psz && (!buf || len < n))
+    while ( *psz && (!buf || len < n) )
     {
-        if (buf)
+        if ( buf )
         {
             ((char *)buf)[0] = psz[1];
             ((char *)buf)[1] = psz[0];
             buf++;
         }
         len++;
-        psz += sizeof(wxUint16);
+        psz += 2;
     }
-    if (buf && len<n)   *buf=0;
+
+    if ( buf && len < n )
+        *buf = L'\0';
 
     return len;
 }