sw/source/core/doc/docnum.cxx | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
New commits:
commit ffbad093368fc307ddeb128c6654d67f967f2c9f
Author: Miklos Vajna <vmik...@collabora.co.uk>
Date: Fri Nov 8 15:57:04 2013 +0100
SwDoc::DelNumRule: fix out-of-bounds index access
When nPos == USHRT_MAX, even if later we checked for that case, just for
the sake of an assert(), we already called operator[] with nPos.
(To reproduce: right click on List 1 -> New -> Cancel, results in a
crash.)
Change-Id: I465b5519000b79bd8b2eaa3b3c1ceb80a182a25a
diff --git a/sw/source/core/doc/docnum.cxx b/sw/source/core/doc/docnum.cxx
index db5dd76..c6be765 100644
--- a/sw/source/core/doc/docnum.cxx
+++ b/sw/source/core/doc/docnum.cxx
@@ -1005,13 +1005,16 @@ bool SwDoc::DelNumRule( const OUString& rName, bool
bBroadcast )
{
sal_uInt16 nPos = FindNumRule( rName );
+ if (nPos == USHRT_MAX)
+ return false;
+
if ( (*mpNumRuleTbl)[ nPos ] == GetOutlineNumRule() )
{
OSL_FAIL( "<SwDoc::DelNumRule(..)> - No deletion of outline list
style. This is serious defect - please inform OD" );
return false;
}
- if( USHRT_MAX != nPos && !IsUsed( *(*mpNumRuleTbl)[ nPos ] ))
+ if( !IsUsed( *(*mpNumRuleTbl)[ nPos ] ))
{
if (GetIDocumentUndoRedo().DoesUndo())
{
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
