From a8640c6225a03e3d379a4e9daec7c585e7f252fc Mon Sep 17 00:00:00 2001
From: Albrecht Schlosser <albrechts.fltk@online.de>
Date: Fri, 25 Jan 2019 17:58:20 +0100
Subject: [PATCH] Fix Fl_Tree::insert() with pos out ouf range (#18)

The given position to insert a new item was not checked  against the
valid range so the program  could crash if a position less than zero
or greater than children() was given. The position is now clamped to
the valid range, i.e. the item is either prepended or appended.

Fixes issue #18.

Backported from 1.4, commit 9b272cfa4e66
---
 CHANGES                    |  1 +
 src/Fl_Tree.cxx            |  6 ++++++
 src/Fl_Tree_Item.cxx       | 15 +++++++++++----
 src/Fl_Tree_Item_Array.cxx |  7 ++++++-
 4 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/CHANGES b/CHANGES
index 3faa7d7b1..ab2f36d2b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,7 @@ New features and enhancements (highlights)
 
 Bug fixes and other improvements
 
+	- Fix Fl_Tree::insert() with pos out ouf range (issue #18).
 	- Fix Fl_GIF_Image Color Table handling (STR 3491).
 	- Make sure not to access Fl_Menu_ widgets if the widget gets
 	  deleted while the menu (pulldown) is open (STR 3503).
diff --git a/src/Fl_Tree.cxx b/src/Fl_Tree.cxx
index 5432c9d78..c99dd26a2 100644
--- a/src/Fl_Tree.cxx
+++ b/src/Fl_Tree.cxx
@@ -1078,6 +1078,12 @@ Fl_Tree_Item* Fl_Tree::insert_above(Fl_Tree_Item *above, const char *name) {
 
 /// Insert a new item \p 'name' into \p 'item's children at position \p 'pos'.
 ///
+/// If \p pos is out of range the new item is
+///  - prepended if \p pos \< 0 or
+///  - appended  if \p pos \> item->children().
+///
+/// Note: \p pos == children() is not considered out of range: the item is
+/// appended to the child list.
 /// Example:
 /// \code
 /// tree->add("Aaa/000");       // "000" is index 0 in Aaa's children
diff --git a/src/Fl_Tree_Item.cxx b/src/Fl_Tree_Item.cxx
index 04c15401d..dd1132a1f 100644
--- a/src/Fl_Tree_Item.cxx
+++ b/src/Fl_Tree_Item.cxx
@@ -431,10 +431,17 @@ Fl_Tree_Item *Fl_Tree_Item::add(const Fl_Tree_Prefs &prefs,
 	 : 0;				      // failed? error
 }
 
-/// Insert a new item named \p 'new_label' into current item's
-/// children at a specified position \p 'pos'.
-/// \returns the new item inserted.
-///
+/**
+  Insert a new item named \p 'new_label' into current item's
+  children at a specified position \p 'pos'.
+
+  If \p pos is out of range the new item is
+   - prepended if \p pos \< 0 or
+   - appended  if \p pos \> item->children().
+
+  \returns the new item inserted
+  \see Fl_Tree::insert()
+*/
 Fl_Tree_Item *Fl_Tree_Item::insert(const Fl_Tree_Prefs &prefs, const char *new_label, int pos) {
 #if FLTK_ABI_VERSION >= 10303
   Fl_Tree_Item *item = new Fl_Tree_Item(_tree);
diff --git a/src/Fl_Tree_Item_Array.cxx b/src/Fl_Tree_Item_Array.cxx
index 7f7476569..e743800a6 100644
--- a/src/Fl_Tree_Item_Array.cxx
+++ b/src/Fl_Tree_Item_Array.cxx
@@ -121,9 +121,14 @@ void Fl_Tree_Item_Array::enlarge(int count) {
 /// Insert an item at index position \p pos.
 ///
 ///     Handles enlarging array if needed, total increased by 1.
-///     If \p pos == total(), an empty item is appended to the array.
+///     If \p pos \>= total(), the item is appended to the array.
+///     If \p pos \< 0, the item is prepended (works like pos == 0).
 ///
 void Fl_Tree_Item_Array::insert(int pos, Fl_Tree_Item *new_item) {
+  if (pos < 0)
+    pos = 0;
+  else if (pos > _total)
+    pos = _total;
   enlarge(1);
   // printf("*** POS=%d TOTAL-1=%d NITEMS=%d\n", pos, _total-1, (_total-pos));
   if ( pos <= (_total - 1) ) {	// need to move memory around?