Author: hdu
Date: Tue Jul 16 13:30:18 2013
New Revision: 1503709
URL: http://svn.apache.org/r1503709
Log:
#i122752# check iterator in each iteration of
CFormatEtcContainer::nextFormatEtc()'s loop
Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator beyond
the container bounds. The comparable loop in
CFormatEtcContainer::skipFormatEtc()
already checks the iterator against the container end in each iteration.
Modified:
openoffice/trunk/ (props changed)
openoffice/trunk/main/dtrans/source/win32/dtobj/FetcList.cxx
Propchange: openoffice/trunk/
------------------------------------------------------------------------------
Reverse-merged /incubator/ooo/branches/alg/linecap:r1226811-1232461
Reverse-merged /openoffice/branches/sidebar:r1415095-1466374
Reverse-merged /openoffice/branches/alg/clibboard:r1428975-1437368
Reverse-merged /incubator/ooo/branches/alg/svgreplacement:r1205420-1220782
Reverse-merged
/incubator/ooo/branches/AOO34:r1346776-1346777,1347535,1348052,1348914,1350569,1352456,1358991,1359004,1359010,1359024,1359546-1359547,1359553,1359555-1359556,1360552,1368968,1369110,1371068
Reverse-merged /incubator/ooo/branches/writer001:r1356067-1386577
Merged /openoffice/branches/AOO400:r1503684
Modified: openoffice/trunk/main/dtrans/source/win32/dtobj/FetcList.cxx
URL:
http://svn.apache.org/viewvc/openoffice/trunk/main/dtrans/source/win32/dtobj/FetcList.cxx?rev=1503709&r1=1503708&r2=1503709&view=diff
==============================================================================
--- openoffice/trunk/main/dtrans/source/win32/dtobj/FetcList.cxx (original)
+++ openoffice/trunk/main/dtrans/source/win32/dtobj/FetcList.cxx Tue Jul 16
13:30:18 2013
@@ -143,10 +143,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer:
sal_uInt32 nFetched = 0;
- if ( m_EnumIterator != m_FormatMap.end( ) )
+ for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++,
++m_EnumIterator )
{
- for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++,
++m_EnumIterator )
- CopyFormatEtc( lpFetc, *m_EnumIterator );
+ if ( m_EnumIterator == m_FormatMap.end() )
+ break;
+ CopyFormatEtc( lpFetc, *m_EnumIterator );
}
return nFetched;
