[Foxgui-users] Invalid read in FXText::paintCursor (FOX 1.7.54)

[Frank W. <fw...@so...>]

Hi,

I just noticed a problem in the functions

  * void FXText::paintCursor(FXDCWindow& dc) const, and
  * void FXText::eraseCursor(FXDCWindow& dc) const

of the latest version (1.7.54) of FXText (1.7.53 is still fine).

If the current cursor position is at the end of the buffer, the statement

    tw=font->getCharWidth((*c=getChar(cursorpos)*)>=' '?c:' ');

accesses an invalid memory region (just beyond the allocated buffer).

The problem can be fixed by using

    tw=font->getCharWidth((*c=cursorpos<length?getChar(cursorpos):'
    '*)>=' '?c:' ');

instead.

Maybe it would be even better if the function

    FXwchar FXText::getChar(FXint pos) const

would use a validity check for its parameter (and then return 0 for
invalid positions)?!

Kind regards,
    Frank

-- 
  \ /           Sol-3 GmbH & Co. KG             Frank Weimer
 --o-- Sol-3    An der Klostermühle 1           Phone: +49 6123 7029 24
  / \           D-65399 Kiedrich                Fax:   +49 6123 7029 29
                USt-ID:   DE 204978307          eMail: fw...@so...
                Register: WI HRA 6607
                Komplementär:    Sol-3 Verwaltungs-GmbH
                Register:        WI HRB 117786
                Geschäftsführer: Norbert Geus, Dirk Zoller