Fix a bug in Pointer

const586 · May 9, 2015 · 63a1db0 · 63a1db0
1 parent 771fa98
commit 63a1db0
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/include/rapidjson/pointer.h b/include/rapidjson/pointer.h
@@ -205,7 +205,7 @@ class GenericPointer {
     GenericPointer Append(const Token& token, Allocator* allocator = 0) const {
         GenericPointer r;
         r.allocator_ = allocator;
-        Ch *p = r.CopyFromRaw(*this, 1, (token.length + 1) * sizeof(Ch));
+        Ch *p = r.CopyFromRaw(*this, 1, token.length + 1);
         std::memcpy(p, token.name, (token.length + 1) * sizeof(Ch));
         r.tokens_[tokenCount_].name = p;
         r.tokens_[tokenCount_].length = token.length;
@@ -284,6 +284,7 @@ class GenericPointer {
             return Append(token.GetString(), token.GetStringLength(), allocator);
         else {
             RAPIDJSON_ASSERT(token.IsUint64());
+            RAPIDJSON_ASSERT(token.GetUint64() <= SizeType(~0));
             return Append(static_cast<SizeType>(token.GetUint64()), allocator);
         }
     }
@@ -724,7 +725,7 @@ class GenericPointer {
     /*!
         \param rhs Source pointer.
         \param extraToken Extra tokens to be allocated.
-        \param extraNameBufferSize Extra name buffer size to be allocated.
+        \param extraNameBufferSize Extra name buffer size (in number of Ch) to be allocated.
         \return Start of non-occupied name buffer, for storing extra names.
     */
     Ch* CopyFromRaw(const GenericPointer& rhs, size_t extraToken = 0, size_t extraNameBufferSize = 0) {
@@ -734,7 +735,7 @@ class GenericPointer {
         size_t nameBufferSize = rhs.tokenCount_; // null terminators for tokens
         for (Token *t = rhs.tokens_; t != rhs.tokens_ + rhs.tokenCount_; ++t)
             nameBufferSize += t->length;
-        nameBuffer_ = (Ch*)allocator_->Malloc(nameBufferSize * sizeof(Ch)+extraNameBufferSize);
+        nameBuffer_ = (Ch*)allocator_->Malloc((nameBufferSize + extraNameBufferSize) * sizeof(Ch));
         std::memcpy(nameBuffer_, rhs.nameBuffer_, nameBufferSize * sizeof(Ch));
 
         tokenCount_ = rhs.tokenCount_ + extraToken;
@@ -746,7 +747,7 @@ class GenericPointer {
         for (Token *t = tokens_; t != tokens_ + rhs.tokenCount_; ++t)
             t->name += diff;
 
-        return nameBuffer_ + nameBufferSize * sizeof(Ch);
+        return nameBuffer_ + nameBufferSize;
     }
 
     //! Check whether a character should be percent-encoded.