[Libreoffice-commits] core.git: Branch 'libreoffice-4-1-0' - dtrans/source

[Herbert Dürr]

 dtrans/source/win32/dtobj/FetcList.cxx |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

New commits:
commit 0a05964ece1d8f71fc6a65376a7996a83798e98c
Author: Herbert Dürr <hdu at apache.org>
Date:   Tue Jul 16 13:30:18 2013 +0000

    i#122752 check iterator in each iteration of the loop
    
    Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator beyond
    the container bounds. The comparable loop in CFormatEtcContainer::skipFormatEtc()
    already checks the iterator against the container end in each iteration.
    
    (cherry picked from commit a609daa146c5588c6a35c2c145e9573c625ec123)
    
    Signed-off-by: Jan Holesovsky <kendy at suse.cz>
    (cherry picked from commit 8201fd59b41700947e4a550208251b2537617358)
    
    Change-Id: I856f5915ea2e062acb43ef21c3e49ff92e719697
    Reviewed-on: https://gerrit.libreoffice.org/4946
    Reviewed-by: Norbert Thiebaud <nthiebaud at gmail.com>
    Reviewed-by: Michael Meeks <michael.meeks at suse.com>
    Tested-by: Michael Meeks <michael.meeks at suse.com>

diff --git a/dtrans/source/win32/dtobj/FetcList.cxx b/dtrans/source/win32/dtobj/FetcList.cxx
index b728850..561f894 100644
--- a/dtrans/source/win32/dtobj/FetcList.cxx
+++ b/dtrans/source/win32/dtobj/FetcList.cxx
@@ -131,10 +131,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer::nextFormatEtc( LPFORMATETC lpFetc,
 
     sal_uInt32 nFetched = 0;
 
-    if ( m_EnumIterator != m_FormatMap.end( ) )
+    for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
     {
-        for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
-            CopyFormatEtc( lpFetc, *m_EnumIterator );
+        if ( m_EnumIterator == m_FormatMap.end() )
+            break;
+        CopyFormatEtc( lpFetc, *m_EnumIterator );
     }
 
     return nFetched;