From: Chulheon <ch.jeong47@samsung.com>
Date: Fri, 7 Jun 2013 11:32:12 +0000 (+0900)
Subject: fixed bug (invalid memory access N_SE-40738)
X-Git-Tag: accepted/tizen/20130924.144426~1^2~653^2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=1aa1e0bbbcf1bd2ad827c9b955f631c220bd7be0;p=platform%2Fframework%2Fnative%2Fuifw.git

fixed bug (invalid memory access N_SE-40738)

Change-Id: Ib377d547489f320db644ae523544de42143243e2
---

diff --git a/src/ui/controls/FUiCtrl_EditPresenter.cpp b/src/ui/controls/FUiCtrl_EditPresenter.cpp
index 158e0a0..4c3cb26 100755
--- a/src/ui/controls/FUiCtrl_EditPresenter.cpp
+++ b/src/ui/controls/FUiCtrl_EditPresenter.cpp
@@ -5350,41 +5350,45 @@ _EditPresenter::DeleteCharacterAt(int index)
 }
 
 result
-_EditPresenter::DeleteText(int start, int end)
+_EditPresenter::DeleteText(int startCursorPosition, int endCursorPosition)
 {
 	result r = E_SUCCESS;
 
 	int length = GetTextLength();
 
-	SysTryReturnResult(NID_UI_CTRL, -1 < start && start < end, E_INVALID_ARG, "[EDIT] Invalid argument is given.");
-	SysTryReturnResult(NID_UI_CTRL, start < end && end <= length, E_INVALID_ARG, "[EDIT] Invalid argument is given.");
+	SysTryReturnResult(NID_UI_CTRL, -1 < startCursorPosition && startCursorPosition < endCursorPosition, E_INVALID_ARG, "[EDIT] Invalid argument is given.");
+	SysTryReturnResult(NID_UI_CTRL, startCursorPosition < endCursorPosition && endCursorPosition <= length, E_INVALID_ARG, "[EDIT] Invalid argument is given.");
 
-	_Text::TextElement* pFirstTextElement = __pTextObject->GetElementAtTextIndex(start);
+	_Text::TextElement* pFirstTextElement = __pTextObject->GetElementAtTextIndex(startCursorPosition);
 	const TextSimple* pFirstSimpleText = dynamic_cast <const TextSimple*>(pFirstTextElement);
 	if (pFirstSimpleText != null && pFirstSimpleText->GetBitmap() != null)
 	{
-		if (pFirstSimpleText->GetTextOffset() < start)
+		if (pFirstSimpleText->GetTextOffset() < startCursorPosition)
 		{
-			start = pFirstSimpleText->GetTextOffset();
+			startCursorPosition = pFirstSimpleText->GetTextOffset();
 		}
 	}
-	_Text::TextElement* pLastTextElement = __pTextObject->GetElementAtTextIndex(end - 1);
+	_Text::TextElement* pLastTextElement = __pTextObject->GetElementAtTextIndex(endCursorPosition - 1);
 	const TextSimple* pLastSimpleText = dynamic_cast <const TextSimple*>(pLastTextElement);
 	if (pLastSimpleText != null && pLastSimpleText->GetBitmap() != null)
 	{
-		if( (pLastSimpleText->GetTextOffset() + pLastSimpleText->GetTextLength()) > end)
+		if( (pLastSimpleText->GetTextOffset() + pLastSimpleText->GetTextLength()) > endCursorPosition)
 		{
-			end = pLastSimpleText->GetTextOffset() + pLastSimpleText->GetTextLength();
+			endCursorPosition = pLastSimpleText->GetTextOffset() + pLastSimpleText->GetTextLength();
 		}
 	}
 
-	r = __pTextString->Remove(start, end - start);
+	r = __pTextString->Remove(startCursorPosition, endCursorPosition - startCursorPosition);
 	SysTryReturn(NID_UI_CTRL, r == E_SUCCESS, r, r, "[%s] Propagating.", GetErrorMessage(r));
 
 	int currentLength = __pTextString->GetLength();
 
-	for (int i = start; i < length; i++)
+	for (int i = startCursorPosition; i < length; i++)
 	{
+		if ((i + length - currentLength) >= length)
+		{
+			break;
+		}
 		__pTextBuffer[i] = __pTextBuffer[i + (length - currentLength)];
 	}
 
@@ -5393,10 +5397,10 @@ _EditPresenter::DeleteText(int start, int end)
 		__pTextBuffer[i] = 0;
 	}
 
-	SetCursorPosition(start);
+	SetCursorPosition(startCursorPosition);
 
-	__pTextObject->SetRange(start, end - start);
-	r = __pTextObject->NotifyTextChanged(__pTextBuffer, 0, currentLength, -(end - start));
+	__pTextObject->SetRange(startCursorPosition, endCursorPosition - startCursorPosition);
+	r = __pTextObject->NotifyTextChanged(__pTextBuffer, 0, currentLength, -(endCursorPosition - startCursorPosition));
 	r = __pTextObject->Compose();
 
 	if (__pEdit->GetEditStyle() & EDIT_STYLE_FLEXIBLE)
diff --git a/src/ui/inc/FUiCtrl_EditPresenter.h b/src/ui/inc/FUiCtrl_EditPresenter.h
index 7dfd844..bdacda0 100644
--- a/src/ui/inc/FUiCtrl_EditPresenter.h
+++ b/src/ui/inc/FUiCtrl_EditPresenter.h
@@ -272,7 +272,7 @@ public:
 	virtual result CutText(void);
 	result DeleteCharacterAt(int index);
 	result DeleteCharacterAtCursorPosition(void);
-	result DeleteText(int start, int end);
+	result DeleteText(int startCursorPosition, int endCursorPosition);
 	void SetCursorDisabled(bool disabled);
 	result HideKeypad(bool focus = false);
 	void ChangeKeypadStatus(void);