summaryrefslogtreecommitdiff
path: root/dtrans
diff options
context:
space:
mode:
authorHerbert Dürr <hdu@apache.org>2013-07-16 13:30:18 +0000
committerJan Holesovsky <kendy@suse.cz>2013-07-17 09:03:56 +0200
commit8201fd59b41700947e4a550208251b2537617358 (patch)
treee7393cce9fb99126514dd9f961ab2e0f670c5d60 /dtrans
parent699b7626222ea8be1c9713a7f5e274dbfbc029ff (diff)
#i122752# check iterator in each iteration of CFormatEtcContainer::nextFormatEtc()'s loop
Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator beyond the container bounds. The comparable loop in CFormatEtcContainer::skipFormatEtc() already checks the iterator against the container end in each iteration. (cherry picked from commit a609daa146c5588c6a35c2c145e9573c625ec123) Signed-off-by: Jan Holesovsky <kendy@suse.cz>
Diffstat (limited to 'dtrans')
-rw-r--r--dtrans/source/win32/dtobj/FetcList.cxx7
1 files changed, 4 insertions, 3 deletions
diff --git a/dtrans/source/win32/dtobj/FetcList.cxx b/dtrans/source/win32/dtobj/FetcList.cxx
index b728850fc72b..561f8945fa22 100644
--- a/dtrans/source/win32/dtobj/FetcList.cxx
+++ b/dtrans/source/win32/dtobj/FetcList.cxx
@@ -131,10 +131,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer::nextFormatEtc( LPFORMATETC lpFetc,
sal_uInt32 nFetched = 0;
- if ( m_EnumIterator != m_FormatMap.end( ) )
+ for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
{
- for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
- CopyFormatEtc( lpFetc, *m_EnumIterator );
+ if ( m_EnumIterator == m_FormatMap.end() )
+ break;
+ CopyFormatEtc( lpFetc, *m_EnumIterator );
}
return nFetched;