openoffice-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From h..@apache.org
Subject svn commit: r1503684 - /openoffice/branches/AOO400/main/dtrans/source/win32/dtobj/FetcList.cxx
Date Tue, 16 Jul 2013 12:37:34 GMT
Author: hdu
Date: Tue Jul 16 12:37:34 2013
New Revision: 1503684

URL: http://svn.apache.org/r1503684
Log:
#i122752# check iterator in each iteration of CFormatEtcContainer::nextFormatEtc()'s loop

Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator beyond
the container bounds. The comparable loop in CFormatEtcContainer::skipFormatEtc()
already checks the iterator against the container end in each iteration.

Modified:
    openoffice/branches/AOO400/main/dtrans/source/win32/dtobj/FetcList.cxx

Modified: openoffice/branches/AOO400/main/dtrans/source/win32/dtobj/FetcList.cxx
URL: http://svn.apache.org/viewvc/openoffice/branches/AOO400/main/dtrans/source/win32/dtobj/FetcList.cxx?rev=1503684&r1=1503683&r2=1503684&view=diff
==============================================================================
--- openoffice/branches/AOO400/main/dtrans/source/win32/dtobj/FetcList.cxx (original)
+++ openoffice/branches/AOO400/main/dtrans/source/win32/dtobj/FetcList.cxx Tue Jul 16 12:37:34
2013
@@ -143,10 +143,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer:
 
 	sal_uInt32 nFetched = 0;
 
-	if ( m_EnumIterator != m_FormatMap.end( ) )
+	for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
 	{
-		for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
-			CopyFormatEtc( lpFetc, *m_EnumIterator );
+		if ( m_EnumIterator == m_FormatMap.end() )
+			break;
+		CopyFormatEtc( lpFetc, *m_EnumIterator );
 	}
 
 	return nFetched;



Mime
View raw message