[wxWidgets/wxWidgets] 9b0eb8: Fix out-of-bounds read on trailing backslash in wx...

[Javid Khan]

Branch: refs/heads/master
Home: https://github.com/wxWidgets/wxWidgets
Commit: 9b0eb807cd03eb9ba517b8d5371c91d811a7682b
https://github.com/wxWidgets/wxWidgets/commit/9b0eb807cd03eb9ba517b8d5371c91d811a7682b
Author: dxbjavid <dxbj...@gmail.com>
Date: 2026-06-01 (Mon, 01 Jun 2026)

Changed paths:
M src/common/regex.cpp
M tests/regex/wxregextest.cpp

Log Message:
-----------
Fix out-of-bounds read on trailing backslash in wxRegEx::Replace()

wxRegExImpl::Replace() scans replacement.c_str() and does *++p after a
backslash. When the replacement ends in a lone backslash, that reads the
terminating NUL, the else branch appends it, and the loop's p++ then
steps one byte past the NUL so the *p condition reads out of bounds.

Keep a trailing backslash verbatim and stop before the increment.

Add a test checking that this doesn't result in ASAN errors any more.

Closes #26541.



To unsubscribe from these emails, change your notification settings at https://github.com/wxWidgets/wxWidgets/settings/notifications