From f5de8cd3e1639e799b60ec21e5acbf8169aacb88 Mon Sep 17 00:00:00 2001 From: Maciej Suminski Date: Wed, 12 Sep 2018 10:53:16 +0200 Subject: [PATCH] Fix a possible out-of-bounds access in WX_GRID::SetTable() --- common/widgets/wx_grid.cpp | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/common/widgets/wx_grid.cpp b/common/widgets/wx_grid.cpp index e9f309d15a..f289b298a7 100644 --- a/common/widgets/wx_grid.cpp +++ b/common/widgets/wx_grid.cpp @@ -47,14 +47,18 @@ void WX_GRID::SetTable( wxGridTableBase* aTable, bool aTakeOwnership ) { // wxGrid::SetTable() messes up the column widths from wxFormBuilder so we have to save // and restore them. - int* formBuilderColWidths = new int[ GetNumberCols() ]; + int numberCols = GetNumberCols(); + int* formBuilderColWidths = new int[numberCols]; - for( int i = 0; i < GetNumberCols(); ++i ) + for( int i = 0; i < numberCols; ++i ) formBuilderColWidths[ i ] = GetColSize( i ); wxGrid::SetTable( aTable ); + // wxGrid::SetTable() may change the number of columns, + // so prevent out-of-bounds access to formBuildColWidths + numberCols = std::min( numberCols, GetNumberCols() ); - for( int i = 0; i < GetNumberCols(); ++i ) + for( int i = 0; i < numberCols; ++i ) { // correct wxFormBuilder width for large fonts and/or long translations int headingWidth = GetTextExtent( GetColLabelValue( i ) ).x + 2 * MIN_GRIDCELL_MARGIN; @@ -191,4 +195,4 @@ bool WX_GRID::CommitPendingChanges( bool aQuietMode ) } return true; -} \ No newline at end of file +}