diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-03-24 16:15:28 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-03-24 20:45:56 +0000 |
| commit | 7e5e61dc529cf359309d3cdb944760905e5262c5 (patch) | |
| tree | 6864c34aa46ee757f758bf236bd1d8e77cfc1698 | |
| parent | 59475ae16329edd32d286eb912c3f52d3395c818 (diff) | |
Resolves: fdo#73466 overflow on addition to COMPLETE_STRING
sw/source/core/text/itrcrsr.cxx:1632
SwTxtSizeInfo aSizeInf( GetInfo(), &rText, nCurrStart )
where nCurrStart is non 0 and the hidden 4th argument to SwTxtSizeInfo is
COMPLETE_STRING
in the past it was STRING_LEN unsigned 16bit 0xFFFF and so in GetMinLen in
sw/source/core/text/inftxt.cxx adding x to it resulted in x-1 which at least is
in bounds if selected by the std::min
Change-Id: I78f176804b79fb3c991677adb016579eabcfd56f
| -rw-r--r-- | sw/source/core/text/inftxt.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sw/source/core/text/inftxt.cxx b/sw/source/core/text/inftxt.cxx index fcc2794446b8..ea96e08e8986 100644 --- a/sw/source/core/text/inftxt.cxx +++ b/sw/source/core/text/inftxt.cxx @@ -182,8 +182,11 @@ void ChkOutDev( const SwTxtSizeInfo &rInf ) inline sal_Int32 GetMinLen( const SwTxtSizeInfo &rInf ) { + const sal_Int32 nTxtLen = rInf.GetTxt().getLength(); + if (rInf.GetLen() == COMPLETE_STRING) + return nTxtLen; const sal_Int32 nInfLen = rInf.GetIdx() + rInf.GetLen(); - return std::min( rInf.GetTxt().getLength(), nInfLen ); + return std::min(nTxtLen, nInfLen); } SwTxtSizeInfo::SwTxtSizeInfo( const SwTxtSizeInfo &rNew ) |