[Libreoffice-commits] core.git: Branch 'distro/collabora/co-22.05' - sc/source

[Caolán McNamara (via logerrit)]

 sc/source/filter/oox/condformatbuffer.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 631f99be735735fd3422516441f18bff7782972c
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed Jun 14 15:37:08 2023 +0100
Commit:     Henry Castro <hcas...@collabora.com>
CommitDate: Thu Jun 15 22:42:51 2023 +0200

    cid#1532384 Out-of-bounds read
    
    sizeof returns num of bytes, not num of elements
    
    Change-Id: I9dea109e5f322d93ee10680f120b15554efa92e1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153070
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Henry Castro <hcas...@collabora.com>

diff --git a/sc/source/filter/oox/condformatbuffer.cxx 
b/sc/source/filter/oox/condformatbuffer.cxx
index 568a4197b070..7dfc73a4ca7c 100644
--- a/sc/source/filter/oox/condformatbuffer.cxx
+++ b/sc/source/filter/oox/condformatbuffer.cxx
@@ -265,7 +265,7 @@ static ::Color IndexedColors[] = {
     else if (rAttribs.hasAttribute(XML_indexed))
     {
         sal_uInt32 nIndexed = rAttribs.getUnsigned(XML_indexed, 0);
-        if (nIndexed < sizeof(IndexedColors))
+        if (nIndexed < std::size(IndexedColors))
             nColor = IndexedColors[nIndexed];
     }