diff options
| author | Eike Rathke <erack@redhat.com> | 2013-02-19 19:22:27 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2013-02-22 10:04:12 +0000 |
| commit | 74d1466914547aaa5369f18727c228db9ce88121 (patch) | |
| tree | 2504dbc15fc7d4ad095da60001e62ab77226b6ed /chart2 | |
| parent | e5144e5f49ac04c769accb4e796edfbd6973e137 (diff) | |
do not access vector elements beyond size, rhbz#847519 related
The actual bug (crash) is not triggered anymore because the categories
are assembled differently, nevertheless the code in question could
expose the same behavior under different preconditions.
Change-Id: Ic37f6b34effaf4e5252e80aab46b021547b36efb
(cherry picked from commit d1ba2cd612a4c39976e2980c7dc4e3fa38c88470)
Reviewed-on: https://gerrit.libreoffice.org/2272
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'chart2')
| -rw-r--r-- | chart2/source/tools/ExplicitCategoriesProvider.cxx | 24 |
1 files changed, 15 insertions, 9 deletions
diff --git a/chart2/source/tools/ExplicitCategoriesProvider.cxx b/chart2/source/tools/ExplicitCategoriesProvider.cxx index e3d800f1b1f8..00b481c24e30 100644 --- a/chart2/source/tools/ExplicitCategoriesProvider.cxx +++ b/chart2/source/tools/ExplicitCategoriesProvider.cxx @@ -353,11 +353,14 @@ Sequence< OUString > lcl_getExplicitSimpleCategories( } for( aOuterIt=rComplexCats.begin(); aOuterIt != aOuterEnd; ++aOuterIt ) { - sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt ); - if( nCurrentCount< nMaxCategoryCount ) + if ( !aOuterIt->empty() ) { - ComplexCategory& rComplexCategory = aOuterIt->back(); - rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount); + sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt ); + if( nCurrentCount< nMaxCategoryCount ) + { + ComplexCategory& rComplexCategory = aOuterIt->back(); + rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount); + } } } } @@ -389,12 +392,15 @@ Sequence< OUString > lcl_getExplicitSimpleCategories( OUString aText; for( aOuterIt=aComplexCatsPerIndex.begin() ; aOuterIt != aOuterEnd; ++aOuterIt ) { - OUString aAddText = (*aOuterIt)[nN].Text; - if( !aAddText.isEmpty() ) + if ( static_cast<size_t>(nN) < aOuterIt->size() ) { - if(!aText.isEmpty()) - aText += aSpace; - aText += aAddText; + OUString aAddText = (*aOuterIt)[nN].Text; + if( !aAddText.isEmpty() ) + { + if(!aText.isEmpty()) + aText += aSpace; + aText += aAddText; + } } } aRet[nN]=aText; |