Index: core/include/fxcrt/fx_string.h |
diff --git a/core/include/fxcrt/fx_string.h b/core/include/fxcrt/fx_string.h |
index 91032f9d9773b4e955d6dc6218454739f1aab69d..e8a7c771b72f51f7c2bc5967adf037956e7a9658 100644 |
--- a/core/include/fxcrt/fx_string.h |
+++ b/core/include/fxcrt/fx_string.h |
@@ -15,6 +15,9 @@ class CFX_BinaryBuf; |
typedef int FX_STRSIZE; |
class CFX_ByteStringL; |
class CFX_WideStringL; |
+ |
+// An immutable string with caller-provided storage which must outlive the |
+// string itself. |
class CFX_ByteStringC : public CFX_Object |
{ |
public: |
@@ -37,6 +40,13 @@ public: |
m_Length = ptr ? (FX_STRSIZE)FXSYS_strlen(ptr) : 0; |
} |
+ // |ch| must be an lvalue that outlives the the CFX_ByteStringC. However, |
+ // the use of char rvalues are not caught at compile time. They are |
+ // implicitly promoted to CFX_ByteString (see below) and then the |
+ // CFX_ByteStringC is constructed from the CFX_ByteString via the alternate |
+ // constructor below. The CFX_ByteString then typically goes out of scope |
+ // and |m_Ptr| may be left pointing to invalid memory. Beware. |
+ // TODO(tsepez): Mark single-argument string constructors as explicit. |
CFX_ByteStringC(FX_CHAR& ch) |
{ |
m_Ptr = (FX_LPCBYTE)&ch; |
@@ -64,7 +74,7 @@ public: |
CFX_ByteStringC& operator = (FX_LPCSTR src) |
{ |
m_Ptr = (FX_LPCBYTE)src; |
- m_Length = (FX_STRSIZE)FXSYS_strlen(src); |
+ m_Length = m_Ptr ? (FX_STRSIZE)FXSYS_strlen(src) : 0; |
return *this; |
} |