# HG changeset patch
# User John W. Eaton <jwe@octave.org>
# Date 1272419681 14400
# Node ID 9f55d3ce490af3168a3f57e4784002dd28ecf2c4
# Parent  6a81e809a39259ff90e232e2d65ea8b4c3c50df0
avoid crash when setting graphics property from cellstr object

diff --git a/src/ChangeLog b/src/ChangeLog
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,12 @@
+2010-04-27  John W. Eaton  <jwe@octave.org>
+
+	* graphics.h.in (string_array_property::string_array_property):
+	Index string_vector with [], not ().
+	(string_array_property::string_value): Likewise.
+	(string_array_property::do_set): Likewise.
+	Avoid indexing past last element of string_vector object.
+	Fixes bug #29695.
+
 2010-04-27  Jaroslav Hajek  <highegg@gmail.com>
 
 	* ov-cs-list.cc (octave_cs_list::subsref): New methods. Just gripe.
diff --git a/src/graphics.h.in b/src/graphics.h.in
--- a/src/graphics.h.in
+++ b/src/graphics.h.in
@@ -552,7 +552,7 @@
           string_vector strings (c.numel ());
 
           for (octave_idx_type i = 0; i < c.numel (); i++)
-            strings (i) = c(i).string_value ();
+            strings[i] = c(i).string_value ();
 
           str = strings;
         }
@@ -575,16 +575,16 @@
 
   std::string string_value (void) const 
     { 
-      std::string _str;
+      std::string s;
 
       for (octave_idx_type i = 0; i < str.length (); i++)
         {
-          _str += str(i);
-          if (i != str.length() - 1)
-            _str += separator;
+          s += str[i];
+          if (i != str.length () - 1)
+            s += separator;
         }
 
-      return _str;
+      return s;
     }
 
   Cell cell_value (void) const {return Cell (str);}
@@ -625,7 +625,7 @@
           if (str.numel () == strings.numel ())
             {
               for (octave_idx_type i = 0; i < str.numel (); i++)
-                if (strings (i) != str(i))
+                if (strings[i] != str[i])
                   {
                     replace = true;
                     break;
@@ -645,13 +645,22 @@
           bool replace = false;
           Cell new_cell = val.cell_value ();
 
-          string_vector strings (new_cell.numel ());
-
-          for (octave_idx_type i = 0; i < new_cell.numel (); i++)
+          string_vector strings = new_cell.cellstr_value ();
+
+          octave_idx_type nel = strings.length ();
+
+          if (nel != str.length ())
+            replace = true;
+          else
             {
-              strings (i) = new_cell(i).string_value ();
-              if (strings (i) != str (i))
-                replace = true;
+              for (octave_idx_type i = 0; i < nel; i++)
+                {
+                  if (strings[i] != str[i])
+                    {
+                      replace = true;
+                      break;
+                    }
+                }
             }
 
           if (replace)