diff options
| author | Herbert Dürr <hdu@apache.org> | 2013-07-16 13:30:18 +0000 |
|---|---|---|
| committer | Christian Lohmaier <lohmaier+LibreOffice@googlemail.com> | 2013-07-17 14:55:53 +0200 |
| commit | f0ee145b4871c51b51096f550f3ea685116a3010 (patch) | |
| tree | 2a5bc8065c5629dfb109ba715e36dbe78957d29a | |
| parent | 0f08a823567f802c29cbaf2b327db19aaf720163 (diff) | |
i#122752 check iterator in each iteration of the loop
Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator beyond
the container bounds. The comparable loop in CFormatEtcContainer::skipFormatEtc()
already checks the iterator against the container end in each iteration.
(cherry picked from commit a609daa146c5588c6a35c2c145e9573c625ec123)
Signed-off-by: Jan Holesovsky <kendy@suse.cz>
(cherry picked from commit 8201fd59b41700947e4a550208251b2537617358)
Change-Id: I856f5915ea2e062acb43ef21c3e49ff92e719697
Reviewed-on: https://gerrit.libreoffice.org/4946
Reviewed-by: Norbert Thiebaud <nthiebaud@gmail.com>
Reviewed-by: Michael Meeks <michael.meeks@suse.com>
Tested-by: Michael Meeks <michael.meeks@suse.com>
| -rw-r--r-- | dtrans/source/win32/dtobj/FetcList.cxx | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/dtrans/source/win32/dtobj/FetcList.cxx b/dtrans/source/win32/dtobj/FetcList.cxx index b728850fc72b..561f8945fa22 100644 --- a/dtrans/source/win32/dtobj/FetcList.cxx +++ b/dtrans/source/win32/dtobj/FetcList.cxx @@ -131,10 +131,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer::nextFormatEtc( LPFORMATETC lpFetc, sal_uInt32 nFetched = 0; - if ( m_EnumIterator != m_FormatMap.end( ) ) + for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator ) { - for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator ) - CopyFormatEtc( lpFetc, *m_EnumIterator ); + if ( m_EnumIterator == m_FormatMap.end() ) + break; + CopyFormatEtc( lpFetc, *m_EnumIterator ); } return nFetched; |