summaryrefslogtreecommitdiff
path: root/sd/source/ui
diff options
context:
space:
mode:
authorArmin Le Grand <Armin.Le.Grand@me.com>2015-11-03 12:25:13 +0100
committerAndras Timar <andras.timar@collabora.com>2015-11-05 22:02:48 +0100
commit5f919351aed1b0e80fd10a33ee3ac08b3697efff (patch)
treeb35adf1ab28227e40752262ca470a60bad7abbfc /sd/source/ui
parent3458c7844b3ed8fcb3dcc92dc31ce66d2fc498e3 (diff)
tdf#95298: corrected some out-of-bound accesses to array
the index variable m_FrameList used to reference the current frame uses the state EMTY_FRAMELIST to mark as invalid, which is the max integer number. Thus all usages have to be secured to not use m_FrameList if set to EMPTY_FRAMELIST. This was missing in some places. the max integer number. Thus all usages have to be secured to not use m_FrameList if set to EMPTY_FRAMELIST. This was missing in some places. Reviewed-on: https://gerrit.libreoffice.org/19753 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Katarina Behrens <Katarina.Behrens@cib.de> Cherry-picked from f0cef70cd4164342b218fbee34bf57eedc22c998 Change-Id: Ie1cf4ae2cb79d821f634ec78b621a2647abc61a8 Reviewed-on: https://gerrit.libreoffice.org/19787 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 6b3b080f8cedc1b496022b18e477af0c7361fba3)
Diffstat (limited to 'sd/source/ui')
-rw-r--r--sd/source/ui/dlg/animobjs.cxx10
1 files changed, 6 insertions, 4 deletions
diff --git a/sd/source/ui/dlg/animobjs.cxx b/sd/source/ui/dlg/animobjs.cxx
index 0b033f9c2cc3..5c66014ffc7c 100644
--- a/sd/source/ui/dlg/animobjs.cxx
+++ b/sd/source/ui/dlg/animobjs.cxx
@@ -430,7 +430,8 @@ IMPL_LINK( AnimationWindow, ClickRemoveBitmapHdl, void *, pBtn )
SdPage* pPage = pMyDoc->GetSdPage(0, PK_STANDARD);
SdrObject* pObject;
- if (pBtn == m_pBtnRemoveBitmap)
+ // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access
+ if (pBtn == m_pBtnRemoveBitmap && EMPTY_FRAMELIST != m_nCurrentFrame)
{
delete m_FrameList[m_nCurrentFrame].first;
delete m_FrameList[m_nCurrentFrame].second;
@@ -449,8 +450,8 @@ IMPL_LINK( AnimationWindow, ClickRemoveBitmapHdl, void *, pBtn )
if (m_nCurrentFrame >= m_FrameList.size())
{
- assert(m_FrameList.empty());
- m_nCurrentFrame = EMPTY_FRAMELIST;
+ // tdf#95298 last frame was deleted, try to use the one before it or go on empty state
+ m_nCurrentFrame = m_FrameList.empty() ? EMPTY_FRAMELIST : m_FrameList.size() - 1;
}
}
else // delete everything
@@ -539,7 +540,8 @@ IMPL_LINK_NOARG(AnimationWindow, ModifyTimeHdl)
void AnimationWindow::UpdateControl(bool const bDisableCtrls)
{
- if (!m_FrameList.empty())
+ // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access
+ if (!m_FrameList.empty() && EMPTY_FRAMELIST != m_nCurrentFrame)
{
BitmapEx aBmp(*m_FrameList[m_nCurrentFrame].first);