The parameter to toFixPtString() only controls the decimal places, not the

actual digits. Therefore the buffer was always too small leading to memory
corruption. Use the version that allocates the string for us instead, then trim
it and assign it to the result.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@33566 a95241bf-73f2-0310-859d-f6bbb57e9c96

src/kits/shared/ExpressionParser.cpp

@@ -18,7 +18,7 @@
 #include <m_apm.h>
 
 
-static const int32 kMaxDigits = 64;
+static const int32 kMaxDecimalPlaces = 32;
 
 enum {
 	TOKEN_IDENTIFIER			= 0,
@@ -327,14 +327,10 @@ ExpressionParser::Evaluate(const char* expressionString)
 	if (value == 0)
 		return BString("0");
 
-	BString result;
+	char* buffer = value.toFixPtStringExp(kMaxDecimalPlaces, '.', 0, 0);
-	char* buffer = result.LockBuffer(kMaxDigits + 1);
-		// + 1 for the decimal point
 	if (buffer == NULL)
 		throw ParseException("out of memory", 0);
 
-	value.toFixPtString(buffer, kMaxDigits);
-
 	// remove surplus zeros
 	int32 lastChar = strlen(buffer) - 1;
 	if (strchr(buffer, '.')) {
@@ -343,8 +339,9 @@ ExpressionParser::Evaluate(const char* expressionString)
 		if (buffer[lastChar] == '.')
 			lastChar--;
 	}
-	result.UnlockBuffer(lastChar + 1);
 
+	BString result(buffer, lastChar + 1);
+	free(buffer);
 	return result;
 }