Resolves: tdf#106724 crash when Title property doesn't already exist

because we just write past the end instead of resizing before hand

(cherry picked from commit 4e32e8900e59f9751a60d9fdef80cdf7d500f72f)

Change-Id: I4742980a331b14ca39aff8aa6cfc27db154091ff
Reviewed-on: https://gerrit.libreoffice.org/35652
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>

1 files changed, 8 insertions, 8 deletions

diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 4d7d277abe68..8b35819288b5 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -4328,31 +4328,31 @@ void DomainMapper_Impl::SetFieldResult(OUString const& rResult)
                             uno::Sequence<beans::PropertyValue> aValues ;
                             aProperty >>= aValues;
                             beans::PropertyValue propertyVal;
-                            bool bTitleFound = false;
-                            int i=0;
-                            for (; i < aValues.getLength(); i++)
+                            sal_Int32 nTitleFoundIndex = -1;
+                            for (sal_Int32 i = 0; i < aValues.getLength(); ++i)
                             {
                                 propertyVal = aValues[i];
-                                if(propertyVal.Name == "Title")
+                                if (propertyVal.Name == "Title")
                                 {
-                                    bTitleFound = true;
+                                    nTitleFoundIndex = i;
                                     break;
                                 }
                             }
-                            if(bTitleFound)
+                            if (nTitleFoundIndex != -1)
                             {
                                 OUString titleStr;
                                 uno::Any aValue(propertyVal.Value);
                                 aValue >>= titleStr;
                                 titleStr = titleStr + rResult;
                                 propertyVal.Value = uno::makeAny(titleStr);
-                                aValues[i] = propertyVal;
+                                aValues[nTitleFoundIndex] = propertyVal;
                             }
                             else
                             {
+                                aValues.realloc(aValues.getLength() + 1);
                                 propertyVal.Name = "Title";
                                 propertyVal.Value = uno::makeAny(rResult);
-                                aValues[i] = propertyVal;
+                                aValues[aValues.getLength() - 1] = propertyVal;
                             }
                             xFieldProperties->setPropertyValue("Fields",
                                     uno::makeAny(aValues));