dtrans/source/win32/dtobj/FetcList.cxx | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
New commits:
commit 1366aed01033f10639dcadb5511917391eba01a1
Author: Herbert Dürr <h...@apache.org>
Date: Tue Jul 16 13:30:18 2013 +0000
#i122752# check iterator in each iteration of
CFormatEtcContainer::nextFormatEtc()'s loop
Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator
beyond
the container bounds. The comparable loop in
CFormatEtcContainer::skipFormatEtc()
already checks the iterator against the container end in each iteration.
(cherry picked from commit a609daa146c5588c6a35c2c145e9573c625ec123)
Signed-off-by: Jan Holesovsky <ke...@suse.cz>
Change-Id: Ie745497491679dfb172d78876c3a3731e153243e
Reviewed-on: https://gerrit.libreoffice.org/5241
Reviewed-by: Petr Mladek <pmla...@suse.cz>
Tested-by: Petr Mladek <pmla...@suse.cz>
diff --git a/dtrans/source/win32/dtobj/FetcList.cxx
b/dtrans/source/win32/dtobj/FetcList.cxx
index 7031dac..8a30409 100644
--- a/dtrans/source/win32/dtobj/FetcList.cxx
+++ b/dtrans/source/win32/dtobj/FetcList.cxx
@@ -132,10 +132,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer::nextFormatEtc(
LPFORMATETC lpFetc,
sal_uInt32 nFetched = 0;
- if ( m_EnumIterator != m_FormatMap.end( ) )
+ for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++,
++m_EnumIterator )
{
- for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++,
++m_EnumIterator )
- CopyFormatEtc( lpFetc, *m_EnumIterator );
+ if ( m_EnumIterator == m_FormatMap.end() )
+ break;
+ CopyFormatEtc( lpFetc, *m_EnumIterator );
}
return nFetched;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
