summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEike Rathke <erack@redhat.com>2013-02-19 19:22:27 +0100
committerCaolán McNamara <caolanm@redhat.com>2013-02-22 10:04:12 +0000
commit74d1466914547aaa5369f18727c228db9ce88121 (patch)
tree2504dbc15fc7d4ad095da60001e62ab77226b6ed
parente5144e5f49ac04c769accb4e796edfbd6973e137 (diff)
do not access vector elements beyond size, rhbz#847519 related
The actual bug (crash) is not triggered anymore because the categories are assembled differently, nevertheless the code in question could expose the same behavior under different preconditions. Change-Id: Ic37f6b34effaf4e5252e80aab46b021547b36efb (cherry picked from commit d1ba2cd612a4c39976e2980c7dc4e3fa38c88470) Reviewed-on: https://gerrit.libreoffice.org/2272 Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com>
-rw-r--r--chart2/source/tools/ExplicitCategoriesProvider.cxx24
1 files changed, 15 insertions, 9 deletions
diff --git a/chart2/source/tools/ExplicitCategoriesProvider.cxx b/chart2/source/tools/ExplicitCategoriesProvider.cxx
index e3d800f1b1f8..00b481c24e30 100644
--- a/chart2/source/tools/ExplicitCategoriesProvider.cxx
+++ b/chart2/source/tools/ExplicitCategoriesProvider.cxx
@@ -353,11 +353,14 @@ Sequence< OUString > lcl_getExplicitSimpleCategories(
}
for( aOuterIt=rComplexCats.begin(); aOuterIt != aOuterEnd; ++aOuterIt )
{
- sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt );
- if( nCurrentCount< nMaxCategoryCount )
+ if ( !aOuterIt->empty() )
{
- ComplexCategory& rComplexCategory = aOuterIt->back();
- rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount);
+ sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt );
+ if( nCurrentCount< nMaxCategoryCount )
+ {
+ ComplexCategory& rComplexCategory = aOuterIt->back();
+ rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount);
+ }
}
}
}
@@ -389,12 +392,15 @@ Sequence< OUString > lcl_getExplicitSimpleCategories(
OUString aText;
for( aOuterIt=aComplexCatsPerIndex.begin() ; aOuterIt != aOuterEnd; ++aOuterIt )
{
- OUString aAddText = (*aOuterIt)[nN].Text;
- if( !aAddText.isEmpty() )
+ if ( static_cast<size_t>(nN) < aOuterIt->size() )
{
- if(!aText.isEmpty())
- aText += aSpace;
- aText += aAddText;
+ OUString aAddText = (*aOuterIt)[nN].Text;
+ if( !aAddText.isEmpty() )
+ {
+ if(!aText.isEmpty())
+ aText += aSpace;
+ aText += aAddText;
+ }
}
}
aRet[nN]=aText;