FlameRobin Files

FlameRobin 26.7.4 — Bug Fixes & Robustness Improvements

Released: 2026-07-09

This patch release delivers three targeted correctness and robustness fixes across the SQL formatter, the preferences system, and the numeric type safety of the rendering pipeline. No new features are introduced; this is a pure bug-fix release and a drop-in replacement for v26.7.3.

---

🔢 Fix transaction isolation level preference mismatch (closes [#644])

Symptom: The isolation mode chosen in Preferences → Transaction Settings was silently applied as a different mode in the SQL editor. The shift was cyclic:

Selected in Preferences	Actually applied
Concurrency (default)	Consistency
Dirty Read	Concurrency
Read Committed	Dirty Read
Consistency	Read Committed

Root cause: fr_settings.confdef stored the radiobox option position as a raw integer, while ExecuteSqlFrame cast that integer directly to TransactionIsolationLevel whose underlying enum order is Consistency=0, Concurrency=1, ReadDirty=2, ReadCommitted=3 — a full cyclic mismatch.

Fix:

• Reordered the four radiobox <option> entries in conf-defs/fr_settings.confdef to match the enum declaration order: Consistency → Concurrency → Dirty Read → Read Committed.
• Updated the confdef <default> from 0 to 1 (Concurrency).
• Updated the fallback default in ExecuteSqlFrame.cpp from 3 to 1 (Concurrency) for consistency.

Upgrade note: your saved transactionIsolationLevel value will be re-interpreted under the corrected ordering. Verify your preferred isolation mode in Preferences → Transaction Settings after upgrading and re-save if needed.

---

🛡️ Guard indentSpaces against negative values causing size_t wraparound

Symptom / risk: If FormatterIndentSpaces was set to a negative integer in the configuration, the value was cast directly to size_t inside the wxString constructor:

:::cpp
// Before — unsafe
formattedSql += wxString(L' ', static_cast<size_t>(indentSpaces) * static_cast<size_t>(indentLevel));

A value of -1 would wrap to 18446744073709551615, triggering a multi-gigabyte allocation attempt and a crash or std::bad_alloc.

Fix: Applied std::max(0, ...) at the point the value is read from config in SqlFormatter.cpp:

:::cpp
// After — safe
int indentSpaces = std::max(0, config().get("FormatterIndentSpaces", 4));

This ensures no negative value can ever reach the static_cast<size_t> downstream. <algorithm> was already included so no additional headers were required.

---

🔒 Fix integer overflow: multiplication result converted to larger type (code scanning alert [#463])

Symptom / risk: A code scanning alert flagged a potential signed-integer overflow where the product of two int operands was implicitly widened to a larger type after the multiplication — meaning the overflow could occur before the widening took effect on some platforms and compilers.

Fix: Cast one operand to the target wider type before the multiplication so the arithmetic is performed in the wider domain from the start, eliminating the overflow opportunity.

---

Commits in this release

Commit	Description
66c42c9f	Bump version to 26.7.4 and update changelog
81279dba	Fix transaction isolation level preference mismatch (closes [#644])
af258f02	Guard indentSpaces with std::max(0, ...) to prevent size_t wraparound
45f4b28e	Merge pull request [#645] from mariuz/alert-autofix-463
99331d4d	Fix for code scanning alert no. 463: Multiplication result converted to larger type

Full diff: https://github.com/mariuz/flamerobin/compare/v26.7.3...v26.7.4

---

Upgrading

Drop-in replacement for v26.7.3 and earlier. No database or configuration migration required.