While compiling the recent revision I noticed a warning:
keybinder.cpp: In member function `void wxKeyConfigPanel::OnAssignKey(wxCommandE
vent&)':
keybinder.cpp:2234: warning: 'n' might be used uninitialized in this function
The corresponding lines of the sourcode are:
if (m_pCurrCmd) {
wxKeyBind tmp(m_pKeyField->GetValue());
int n;
#ifdef __WXDEBUG__
bool bind = m_pCurrCmd->IsBindTo(tmp, &n);
wxASSERT_MSG(bind, wxT("the m_pCurrCmd variable should be NULL then..."));
#endif // to avoid warnings in release mode
m_pCurrCmd->RemoveShortcut(n);
}
I don't know what this code should do - I simply don't understand it. But if __WXDEBUG__ is not defined the call to wxCmd::RemoveShortcut uses an uninitialized value. I don't think that this is should be done.
And in wxCmd::RemoveShortcut I suspect the next problem:
void RemoveShortcut(int n) {
for (int i=n; i < m_nShortcuts; i++) // shift array left
m_keyShortcut[i] = m_keyShortcut[i+1];
m_nShortcuts--;
Update();
}
This looks like a buffer overflow because there should be m_nShortcuts elements in the array - but in this part of the code the element with *index* m_nShortcuts is accessed...