[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Help needed for wxWidgets 3.0 transition of TreeviewX



Hi Andreas!

The problem is that the wxString constructor tries to interpret garbage from outside the string buffer. The reason for that is the string length parameter that is explicitly given by the caller "TreeDrawer::DrawText". It passes wxSTRING_MAXLEN as length, which used to mean: "Take the complete string". However, the definition of wxSTRING_MAXLEN was removed from the public API of wxWidgets.

This doesn't show up as compilation error because TreeLib/treedrawer.h has a fall-back definition, that just defines it as 255 - which for wxWidgets is just an arbitrary string length without special meaning. That's why it tried to copy 255 characters (without looking out for the 0 termination), ran out of the string buffer and tried to interpret garbage.

I think someone misinterpreted that parameter for a "maximum-buffer-length-safety-net" kind of parameter (like in snprintf).

The attached patch should fix it. I removed the dangerous fall-back definition (that does more harm than good) and replaced the constructor calls (in which the definition was used) by the appropriate constructor calls.

Cheers,
Martin



El 07/08/14 a les 16:57, Andreas Tille ha escrit:
Hi,

one of the few packages in Debian Med which has more than 100 active
users according to popcon seems to have a serious problem:  The
wxwidgets3.0 transition either injected some bugs or just uncovered
existing bugs.  Since upstream moved away from this program and the
Debian Med team does not have wx-educated people I wonder whether some
kind soul could have a look into this problem.  I guess the problem
can be understood when reading the bug report from here:

    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=751255#31

Any help would be really welcome.

Kind regards

        Andreas.



Description: Remove wxSTRING_MAXLEN (removed in wx3.0) and incomp. definition.
 The definition wxSTRING_MAXLEN was removed from the public API of wxWidgets.
 Its meaning was basically "take all the string", whenever a string length was
 expected. The missing definition didn't raise a compilation error because
 TreeLib's treedrawer.h contained a fall-back definition, which is however
 incompatible with the original definition of wxWidgets and therefore is
 interpreted by wxWidgets as a number representing the real string length.
 This patch gets rid of the dangerous fall-back definition and of all of its
 uses by using alternative wxString constructors that achieve the same
 behavior.
Author: Martin Steghöfer <martin@steghoefer.eu>
Bug-Debian: http://bugs.debian.org/751255

--- treeviewx-0.5.1+20100823.orig/TreeLib/treedrawer.cpp
+++ treeviewx-0.5.1+20100823/TreeLib/treedrawer.cpp
@@ -245,7 +245,7 @@ void TreeDrawer::DrawText (point pt, std
 	// error in gcc, which is probably a gcc bug
 	{
 		wxCoord w, h, descent;
-		wxString s (formatedString.c_str(), wxSTRING_MAXLEN);
+		wxString s (formatedString.c_str());
 		pt.x += dc->GetCharWidth();
 		pt.y -= dc->GetCharHeight()/2;
 		dc->DrawText (s, (int)pt.x, (int)pt.y);
@@ -566,7 +566,7 @@ void PhylogramDrawer::DrawScaleBar ()
 
 #if USE_WXWINDOWS
         wxCoord w, h;
-        wxString s (buf, wxSTRING_MAXLEN);
+        wxString s (buf);
         dc->GetTextExtent (s, &w, &h);
         int x = (int)pt2.x;
         int y = (int)pt2.y;
--- treeviewx-0.5.1+20100823.orig/TreeLib/treedrawer.h
+++ treeviewx-0.5.1+20100823/TreeLib/treedrawer.h
@@ -52,11 +52,6 @@
 #elif USE_WXWINDOWS
 	#define USE_PORT 0
    	#include "wx/wx.h"
-	#ifdef wxSTRING_MAXLEN
-	#else
-		#define wxSTRING_MAXLEN 255
-	#endif
-
 #else
 	#define USE_PORT 1
 #endif

Reply to: