mirror of
https://github.com/wxWidgets/wxWidgets.git
synced 2026-08-17 08:53:06 +08:00
dxbjavidandVadim Zeitlin
2647c0806f
Avoid integer overflow in message catalog StringAtOfs() bounds check: StringAtOfs() read ofsString and nLen from the .mo file and checked ofsString + nLen against the data length, but both are 32-bit so the sum wraps and a translated entry declaring nLen 0xffffffff passes the check; FillHash() then scans past the end of the catalog. Compute the offset as a 64-bit value so the addition can't overflow and result in an invalid index into the buffer. Add a test feeding such a catalog through wxMsgCatalog::CreateFromData(). Closes #26513.