[Libreoffice-commits] core.git: Branch 'distro/collabora/co-23.05' - sc/source

[Caolán McNamara (via logerrit)]

 sc/source/filter/oox/condformatbuffer.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit b56cc148ec30ecbddf32a733fdd13bbbbd1bf68b
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Wed Jun 14 15:37:08 2023 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Fri Jun 16 09:42:52 2023 +0200

    cid#1532384 Out-of-bounds read
    
    sizeof returns num of bytes, not num of elements
    
    Change-Id: I9dea109e5f322d93ee10680f120b15554efa92e1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153070
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Henry Castro <hcas...@collabora.com>
    (cherry picked from commit 631f99be735735fd3422516441f18bff7782972c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153029
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sc/source/filter/oox/condformatbuffer.cxx 
b/sc/source/filter/oox/condformatbuffer.cxx
index c83f4676ba54..42d932908191 100644
--- a/sc/source/filter/oox/condformatbuffer.cxx
+++ b/sc/source/filter/oox/condformatbuffer.cxx
@@ -267,7 +267,7 @@ static ::Color IndexedColors[] = {
     else if (rAttribs.hasAttribute(XML_indexed))
     {
         sal_uInt32 nIndexed = rAttribs.getUnsigned(XML_indexed, 0);
-        if (nIndexed < sizeof(IndexedColors))
+        if (nIndexed < std::size(IndexedColors))
             nColor = IndexedColors[nIndexed];
     }