[Libreoffice-commits] core.git: Branch 'libreoffice-7-6' - sc/source

[Caolán McNamara (via logerrit)]

 sc/source/filter/oox/condformatbuffer.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 002adae14e287afcb3748509b05c843045aa588f
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed Jun 14 15:37:08 2023 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Wed Jun 14 21:09:09 2023 +0200

    cid#1532384 Out-of-bounds read
    
    sizeof returns num of bytes, not num of elements
    
    Change-Id: I9dea109e5f322d93ee10680f120b15554efa92e1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153028
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sc/source/filter/oox/condformatbuffer.cxx 
b/sc/source/filter/oox/condformatbuffer.cxx
index 649046e8b3b7..2662b5213a34 100644
--- a/sc/source/filter/oox/condformatbuffer.cxx
+++ b/sc/source/filter/oox/condformatbuffer.cxx
@@ -264,7 +264,7 @@ namespace {
     else if (rAttribs.hasAttribute(XML_indexed))
     {
         sal_uInt32 nIndexed = rAttribs.getUnsigned(XML_indexed, 0);
-        if (nIndexed < sizeof(IndexedColors))
+        if (nIndexed < std::size(IndexedColors))
             nColor = IndexedColors[nIndexed];
     }