Fix potential UAF in ConcatInPlace.

core/src/fxcrt/fx_basic_wstring.cpp

Index: core/src/fxcrt/fx_basic_wstring.cpp
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp
index da022053b8318acd4227f907d8697a18269d18a6..3717ac7078b0357a098e3bc44cbbf37e6c29c1dc 100644
--- a/core/src/fxcrt/fx_basic_wstring.cpp
+++ b/core/src/fxcrt/fx_basic_wstring.cpp
@@ -237,9 +237,7 @@ void CFX_WideString::ConcatInPlace(FX_STRSIZE nSrcLen, FX_LPCWSTR lpszSrcData)
         return;
     }
     if (m_pData->m_nRefs > 1 || m_pData->m_nDataLength + nSrcLen > m_pData->m_nAllocLength) {
-        StringData* pOldData = m_pData;
         ConcatCopy(m_pData->m_nDataLength, m_pData->m_String, nSrcLen, lpszSrcData);
-        pOldData->Release();
     } else {
         FXSYS_memcpy32(m_pData->m_String + m_pData->m_nDataLength, lpszSrcData, nSrcLen * sizeof(FX_WCHAR));
         m_pData->m_nDataLength += nSrcLen;
@@ -250,13 +248,18 @@ void CFX_WideString::ConcatCopy(FX_STRSIZE nSrc1Len, FX_LPCWSTR lpszSrc1Data,
                                 FX_STRSIZE nSrc2Len, FX_LPCWSTR lpszSrc2Data)
 {
     FX_STRSIZE nNewLen = nSrc1Len + nSrc2Len;
-    if (nNewLen == 0) {
+    if (nNewLen <= 0) {
         return;
     }
+    // Don't release until done copying, might be self-intersection.
+    CFX_StringDataW* pOldData = m_pData;
     m_pData = StringData::Create(nNewLen);
     if (m_pData) {
-        FXSYS_memcpy32(m_pData->m_String, lpszSrc1Data, nSrc1Len * sizeof(FX_WCHAR));
-        FXSYS_memcpy32(m_pData->m_String + nSrc1Len, lpszSrc2Data, nSrc2Len * sizeof(FX_WCHAR));
+        wmemmove(m_pData->m_String, lpszSrc1Data, nSrc1Len);
+        wmemmove(m_pData->m_String + nSrc1Len, lpszSrc2Data, nSrc2Len);
+    }
+    if (pOldData) {

[Lei Zhang, 2015/05/14 22:07:55]

No need for the if () ? It's not in the bstring version, plus the only caller to
ConcatCopy() is ConcatInPlace(), which dereferences |m_pData| before calling
ConcatCopy().

+        pOldData->Release();
     }
 }
 void CFX_WideString::CopyBeforeWrite()