From 1b3b63ed5b05e7fc0f0d88ccdaa4c087c53bfa04 Mon Sep 17 00:00:00 2001
From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Sat, 19 Feb 2011 12:32:48 +0000
Subject: [PATCH] Don't accept invalid values for rows/columns in wxGBSpan
 ctor.

wxGBSpan must have strictly positive row and column span as otherwise the grid
bag sizer code could enter an infinite loop trying to exceed a negative number
which it casted to an unsigned one. And while the cast itself is incorrect too
the program still behaves undesirably (produces a lot of asserts in debug
build and then crashes or crashes directly in release) if a zero size span is
used so it seems better to prevent this from happening.

Closes #12934.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@66964 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---
 include/wx/gbsizer.h | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/include/wx/gbsizer.h b/include/wx/gbsizer.h
index eaea7137b1..f62f891954 100644
--- a/include/wx/gbsizer.h
+++ b/include/wx/gbsizer.h
@@ -53,20 +53,46 @@ private:
 class WXDLLIMPEXP_CORE wxGBSpan
 {
 public:
-    wxGBSpan() : m_rowspan(1), m_colspan(1) {}
-    wxGBSpan(int rowspan, int colspan) : m_rowspan(rowspan), m_colspan(colspan) {}
+    wxGBSpan() { Init(); }
+    wxGBSpan(int rowspan, int colspan)
+    {
+        // Initialize the members to valid values as not doing it may result in
+        // infinite loop in wxGBSizer code if the user passed 0 for any of
+        // them, see #12934.
+        Init();
+
+        SetRowspan(rowspan);
+        SetColspan(colspan);
+    }
 
     // default copy ctor and assignment operator are okay.
 
     int GetRowspan() const { return m_rowspan; }
     int GetColspan() const { return m_colspan; }
-    void SetRowspan(int rowspan) { m_rowspan = rowspan; }
-    void SetColspan(int colspan) { m_colspan = colspan; }
+    void SetRowspan(int rowspan)
+    {
+        wxCHECK_RET( rowspan > 0, "Row span should be strictly positive" );
+
+        m_rowspan = rowspan;
+    }
+
+    void SetColspan(int colspan)
+    {
+        wxCHECK_RET( colspan > 0, "Column span should be strictly positive" );
+
+        m_colspan = colspan;
+    }
 
     bool operator==(const wxGBSpan& o) const { return m_rowspan == o.m_rowspan && m_colspan == o.m_colspan; }
     bool operator!=(const wxGBSpan& o) const { return !(*this == o); }
 
 private:
+    void Init()
+    {
+        m_rowspan =
+        m_colspan = 1;
+    }
+
     int m_rowspan;
     int m_colspan;
 };
-- 
2.45.2