From f434789f342a8eba60da4fb29934d737a1f1d3c1 Mon Sep 17 00:00:00 2001
From: Leland Lucius <github@homerow.net>
Date: Wed, 8 Jul 2015 10:13:34 -0500
Subject: [PATCH] Fix crash in new binary AutoSave

Would happen when writing tags with a value whose length was greater
than 65535 due to the use of shorts.  Now uses int instead.
---
 src/AutoRecovery.cpp | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/AutoRecovery.cpp b/src/AutoRecovery.cpp
index 8a88210fbd..29f434aa18 100644
--- a/src/AutoRecovery.cpp
+++ b/src/AutoRecovery.cpp
@@ -457,7 +457,7 @@ void AutoSaveFile::WriteAttr(const wxString & name, const wxString & value)
    mBuffer.PutC(FT_String);
    WriteName(name);
 
-   short len = value.Length() * sizeof(wxChar);
+   int len = value.Length() * sizeof(wxChar);
 
    mBuffer.Write(&len, sizeof(len));
    mBuffer.Write(value.c_str(), len);
@@ -525,7 +525,7 @@ void AutoSaveFile::WriteData(const wxString & value)
 {
    mBuffer.PutC(FT_Data);
 
-   short len = value.Length() * sizeof(wxChar);
+   int len = value.Length() * sizeof(wxChar);
 
    mBuffer.Write(&len, sizeof(len));
    mBuffer.Write(value.c_str(), len);
@@ -535,7 +535,7 @@ void AutoSaveFile::Write(const wxString & value)
 {
    mBuffer.PutC(FT_Raw);
 
-   short len = value.Length() * sizeof(wxChar);
+   int len = value.Length() * sizeof(wxChar);
 
    mBuffer.Write(&len, sizeof(len));
    mBuffer.Write(value.c_str(), len);
@@ -595,6 +595,7 @@ void AutoSaveFile::CheckSpace(wxMemoryOutputStream & os)
 
 void AutoSaveFile::WriteName(const wxString & name)
 {
+   wxASSERT(name.Length() * sizeof(wxChar) <= SHRT_MAX);
    short len = name.Length() * sizeof(wxChar);
    short id;
 
@@ -771,7 +772,7 @@ bool AutoSaveFile::Decode(const wxString & fileName)
 
          case FT_String:
          {
-            short len;
+            int len;
 
             in.Read(&id, sizeof(id));
             in.Read(&len, sizeof(len));
@@ -866,7 +867,7 @@ bool AutoSaveFile::Decode(const wxString & fileName)
 
          case FT_Data:
          {
-            short len;
+            int len;
 
             in.Read(&len, sizeof(len));
             wxChar *val = new wxChar[len / sizeof(wxChar)];
@@ -879,7 +880,7 @@ bool AutoSaveFile::Decode(const wxString & fileName)
 
          case FT_Raw:
          {
-            short len;
+            int len;
 
             in.Read(&len, sizeof(len));
             wxChar *val = new wxChar[len / sizeof(wxChar)];
-- 
GitLab