diff options
| author | Albrecht Schlosser <albrechts.fltk@online.de> | 2014-10-30 11:47:46 +0000 |
|---|---|---|
| committer | Albrecht Schlosser <albrechts.fltk@online.de> | 2014-10-30 11:47:46 +0000 |
| commit | c3c56594790c60a0571128b1d333efb68c9ad3ef (patch) | |
| tree | 37add605a13a55164e1686567ec505cc6fa2069c /src/Fl_Text_Display.cxx | |
| parent | 637ead9f9975b3037c7bd4b6808e78b137755fa0 (diff) | |
Fix out-of-bounds memory access in Fl_Text_Display (STR #2730).
This bug would only show up in wrap mode.
git-svn-id: file:///fltk/svn/fltk/branches/branch-1.3@10415 ea41ed52-d2ee-0310-a9c1-e6b18d33e121
Diffstat (limited to 'src/Fl_Text_Display.cxx')
| -rw-r--r-- | src/Fl_Text_Display.cxx | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/Fl_Text_Display.cxx b/src/Fl_Text_Display.cxx index 7bd221095..e9f0367bc 100644 --- a/src/Fl_Text_Display.cxx +++ b/src/Fl_Text_Display.cxx @@ -3369,9 +3369,13 @@ void Fl_Text_Display::wrapped_line_counter(Fl_Text_Buffer *buf, int startPos, if (b<lineStart) b = lineStart; if (!foundBreak) { /* no whitespace, just break at margin */ newLineStart = max(p, buf->next_char(lineStart)); - const char *s = buf->address(b); colNum++; - width = measure_proportional_character(s, 0, p+styleBufOffset); + if (b >= buf->length()) { // STR #2730 + width = 0; + } else { + const char *s = buf->address(b); + width = measure_proportional_character(s, 0, p+styleBufOffset); + } } if (p >= maxPos) { *retPos = maxPos; |