[Libreoffice-commits] core.git: sw/source

[Miklos Vajna]

 sw/source/core/doc/docnum.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit ffbad093368fc307ddeb128c6654d67f967f2c9f
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Fri Nov 8 15:57:04 2013 +0100

    SwDoc::DelNumRule: fix out-of-bounds index access
    
    When nPos == USHRT_MAX, even if later we checked for that case, just for
    the sake of an assert(), we already called operator[] with nPos.
    
    (To reproduce: right click on List 1 -> New -> Cancel, results in a
    crash.)
    
    Change-Id: I465b5519000b79bd8b2eaa3b3c1ceb80a182a25a

diff --git a/sw/source/core/doc/docnum.cxx b/sw/source/core/doc/docnum.cxx
index db5dd76..c6be765 100644
--- a/sw/source/core/doc/docnum.cxx
+++ b/sw/source/core/doc/docnum.cxx
@@ -1005,13 +1005,16 @@ bool SwDoc::DelNumRule( const OUString& rName, bool bBroadcast )
 {
     sal_uInt16 nPos = FindNumRule( rName );
 
+    if (nPos == USHRT_MAX)
+        return false;
+
     if ( (*mpNumRuleTbl)[ nPos ] == GetOutlineNumRule() )
     {
         OSL_FAIL( "<SwDoc::DelNumRule(..)> - No deletion of outline list style. This is serious defect - please inform OD" );
         return false;
     }
 
-    if( USHRT_MAX != nPos && !IsUsed( *(*mpNumRuleTbl)[ nPos ] ))
+    if( !IsUsed( *(*mpNumRuleTbl)[ nPos ] ))
     {
         if (GetIDocumentUndoRedo().DoesUndo())
         {