Hi,

Please find the latest report on new defect(s) introduced to LibreOffice found 
with Coverity Scan.

1 new defect(s) introduced to LibreOffice found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent 
build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)


** CID 1666494:         (INTEGER_OVERFLOW)
/sw/source/filter/md/wrtmd.cxx: 805           in 
<unnamed>::OutMarkdown_SwTextNode(SwMDWriter &, const SwTextNode &, bool)()
/sw/source/filter/md/wrtmd.cxx: 818           in 
<unnamed>::OutMarkdown_SwTextNode(SwMDWriter &, const SwTextNode &, bool)()


_____________________________________________________________________________________________
*** CID 1666494:           (INTEGER_OVERFLOW)
/sw/source/filter/md/wrtmd.cxx: 805             in 
<unnamed>::OutMarkdown_SwTextNode(SwMDWriter &, const SwTextNode &, bool)()
799                 }
800             }
801     
802             positions.redlineEnds.sort();
803     
804             // Collect flys anchored to this text node.
>>>     CID 1666494:           (INTEGER_OVERFLOW)
>>>     Expression "++nFly", where "nFly" is known to be equal to 
>>> 18446744073709551615, overflows the type of "++nFly", which is type 
>>> "size_t".
805             for (size_t nFly = 0; nFly < rWrt.GetFlys().size(); ++nFly)
806             {
807                 const SwMDFly& rFly = rWrt.GetFlys()[nFly];
808                 if (rFly.m_nAnchorNodeOffset < rNode.GetIndex())
809                 {
810                     continue;
/sw/source/filter/md/wrtmd.cxx: 818             in 
<unnamed>::OutMarkdown_SwTextNode(SwMDWriter &, const SwTextNode &, bool)()
812                 if (rFly.m_nAnchorNodeOffset > rNode.GetIndex())
813                 {
814                     break;
815                 }
816     
817                 SwMDFly aFly = rWrt.GetFlys().erase_extract(nFly);
>>>     CID 1666494:           (INTEGER_OVERFLOW)
>>>     Expression "--nFly", where "nFly" is known to be equal to 0, underflows 
>>> the type of "--nFly", which is type "size_t".
818                 --nFly;
819                 positions.flys.add(aFly.m_nAnchorContentOffset, 
aFly.m_pFrameFormat);
820             }
821     
822             FormattingStatus currentStatus;
823             while (nStrPos < nEnd)


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, 
https://scan.coverity.com/projects/libreoffice?tab=overview

Reply via email to