Memory bug in XTPMarkupStatic

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   In Source/Controls/Static/XTPMarkupStatic.cpp, a growing buffer is not reallocated correctly.

template<class T>
AFX_INLINE BOOL XTPStrPushChr(T*& pStr, T ch, SIZE_T& nPos, SIZE_T& nSize)
{
    if (NULL == pStr)
    {
        nSize = 0x100;
        pStr  = (T*)malloc(nSize * sizeof(T));
        if (NULL == pStr)
            return FALSE;

        *pStr = T('\0');
        nPos  = 0;
    }

    pStr[nPos] = ch;
    if (++nPos == nSize)
    {
        nSize *= 2;
   // --->>>>     pStr = (T*)realloc(pStr, nSize);
   // Should be:
        pStr = (T*)realloc(pStr, nSize * sizeof(T));
        if (NULL == pStr)
            return FALSE;

        pStr[nPos] = T('\0');
    }

    return TRUE;
}

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
DavidH Members Profile Send Private Message Find Members Posts Add to Buddy List Groupie Joined: 24 March 2007 Status: Offline Points: 62	Post Options Post Reply Quote DavidH Report Post Thanks(0) Quote Reply Topic: Memory bug in XTPMarkupStatic Posted: 2 hours 7 minutes ago at 4:08pm
	In Source/Controls/Static/XTPMarkupStatic.cpp, a growing buffer is not reallocated correctly. template<class T> AFX_INLINE BOOL XTPStrPushChr(T& pStr, T ch, SIZE_T& nPos, SIZE_T& nSize) { if (NULL == pStr) { nSize = 0x100; pStr = (T)malloc(nSize * sizeof(T)); if (NULL == pStr) return FALSE; pStr = T('\0'); nPos = 0; } pStr[nPos] = ch; if (++nPos == nSize) { nSize = 2; *// --->>>> pStr = (T)realloc(pStr, nSize); // Should be: pStr = (T)realloc(pStr, nSize sizeof(T));** if (NULL == pStr) return FALSE; pStr[nPos] = T('\0'); } return TRUE; }