You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@openoffice.apache.org by al...@apache.org on 2014/04/11 17:29:36 UTC
svn commit: r1586681 -
/openoffice/trunk/main/filter/source/msfilter/escherex.cxx
Author: alg
Date: Fri Apr 11 15:29:35 2014
New Revision: 1586681
URL: http://svn.apache.org/r1586681
Log:
i124661 secure possible out of bound access to stl vector content
Modified:
openoffice/trunk/main/filter/source/msfilter/escherex.cxx
Modified: openoffice/trunk/main/filter/source/msfilter/escherex.cxx
URL: http://svn.apache.org/viewvc/openoffice/trunk/main/filter/source/msfilter/escherex.cxx?rev=1586681&r1=1586680&r2=1586681&view=diff
==============================================================================
--- openoffice/trunk/main/filter/source/msfilter/escherex.cxx (original)
+++ openoffice/trunk/main/filter/source/msfilter/escherex.cxx Fri Apr 11 15:29:35 2014
@@ -2604,7 +2604,18 @@ void ConvertEnhancedCustomShapeEquation(
if ( aIter->nOperation & nMask )
{
aIter->nOperation ^= nMask;
- aIter->nPara[ i ] = rEquationOrder[ aIter->nPara[ i ] & 0x3ff ] | 0x400;
+ const sal_Int32 nIndex(aIter->nPara[ i ] & 0x3ff);
+
+ // #124661# check index access, there are cases where this is out of bound leading
+ // to errors up to crashes when executed
+ if(nIndex < rEquationOrder.size())
+ {
+ aIter->nPara[ i ] = rEquationOrder[ nIndex ] | 0x400;
+ }
+ else
+ {
+ OSL_ENSURE(false, "Attempted out of bound access to rEquationOrder of CustomShape (!)");
+ }
}
nMask <<= 1;
}