[ wxwindows-Bugs-1102719 ] Double-free in wxStreamBuffer::SetBufferIO(size_t)

[SourceForge.net]

Bugs item #1102719, was opened at 2005-01-15 01:16
Message generated for change (Comment added) made by xaignar
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=109863&aid=1102719&group_id=9863

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Common
Group: Trivial
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Mikkel S (xaignar)
Assigned to: Nobody/Anonymous (nobody)
Summary: Double-free in wxStreamBuffer::SetBufferIO(size_t)

Initial Comment:
If wxStreamBuffer::SetBufferIO(size_t) is called with a non-zero 
argument on a wxStreamBuffer with an already existing buffer, then 
a double-free will occur, since free will be called on m_buffer_start 
by SetBufferIO(size_t) and then by SetBufferIO(void*, size_t, bool) 
which both calls FreeBuffer(), the problem being that FreeBuffer() 
doesn't NULL m_buffer_start variable after calling free on it. 

----------------------------------------------------------------------

>Comment By: Mikkel S (xaignar)
Date: 2008-01-03 19:08

Message:
Logged In: YES 
user_id=799149
Originator: YES

Just noticed that this bug is still open, even though the problem has
already been fixed.

----------------------------------------------------------------------

Comment By: Kevin Hock (hockkn)
Date: 2005-03-01 19:12

Message:
Logged In: YES 
user_id=801586

Hi, can you please make a patch file and submit your fix as a 
patch? Thanks in advance.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=109863&aid=1102719&group_id=9863