From ccff9fe0f3ef3cc812da9b56bd56b5bc3273ddec Mon Sep 17 00:00:00 2001 From: Vadim Zeitlin Date: Sat, 30 May 2026 23:02:11 +0200 Subject: [PATCH] Make recently added wxXPMDecoder test case really pass We need to use memmove() and not strncpy() in wxXPMDecoder code as nothing guarantees that the source and destination regions don't overlap and they did overlap, in fact, for the test case added as part of 46f928d057 (Fix buffer overflow on invalid width in wxXPMDecoder, 2026-05-27). Also make the test itself more explicit by hard-coding the test XPM instead of constructing it dynamically. See #26519. --- src/common/xpmdecod.cpp | 2 +- tests/image/image.cpp | 11 +++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/common/xpmdecod.cpp b/src/common/xpmdecod.cpp index fe14d6d997..9cbf369055 100644 --- a/src/common/xpmdecod.cpp +++ b/src/common/xpmdecod.cpp @@ -196,7 +196,7 @@ wxImage wxXPMDecoder::ReadFile(wxInputStream& stream) if (*q == '\0') break; - strncpy(xpm_buffer + i, p + 1, q - p - 1); + memmove(xpm_buffer + i, p + 1, q - p - 1); i += q - p - 1; xpm_buffer[i++] = '\n'; p = q + 1; diff --git a/tests/image/image.cpp b/tests/image/image.cpp index 8b6234170c..19cb8714de 100644 --- a/tests/image/image.cpp +++ b/tests/image/image.cpp @@ -1552,12 +1552,11 @@ TEST_CASE_METHOD(ImageHandlersInit, "wxImage::BadXPMWidthOverflow", // wraps to 59, so a one-pixel image line passes the length check and the // key-reading loop then runs off the end of the buffer. Loading such a // file must be rejected. - const std::string key(63, 'a'); - const std::string xpm = - "/* XPM */\n" - "\"68174085 1 1 63\"\n" - "\"" + key + " c #ffffff\"\n" - "\"" + key + "\"\n"; + const std::string xpm = R"("/* XPM */" +"68174085 1 1 63" +"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa c #ffffff" +"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +)"; wxMemoryInputStream mis(xpm.data(), xpm.size()); wxImage img; REQUIRE( !img.LoadFile(mis, wxBITMAP_TYPE_XPM) );