[Libreoffice-commits] core.git: svx/source
Stephan Bergmann
sbergman at redhat.com
Mon Oct 21 08:24:05 PDT 2013
svx/source/gallery2/galtheme.cxx | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
New commits:
commit 5e18e8c597722f78ef8416dff2295dc08c110ceb
Author: Stephan Bergmann <sbergman at redhat.com>
Date: Mon Oct 21 17:22:47 2013 +0200
Check for OUString::copy out-of-bounds arguments
regression introduced with 1287804a89c73e072d57a11ca18988c3e73a77b8 "convert
svx/source/gallery/*.cxx from String to OUString"
Change-Id: Ia8171f2215253b6db8f7eb1f623a6e0c68dc7b94
diff --git a/svx/source/gallery2/galtheme.cxx b/svx/source/gallery2/galtheme.cxx
index e8dbea5..bab0d02 100644
--- a/svx/source/gallery2/galtheme.cxx
+++ b/svx/source/gallery2/galtheme.cxx
@@ -19,6 +19,8 @@
#include "sal/config.h"
+#include <algorithm>
+
#include <comphelper/processfactory.hxx>
#include <tools/urlobj.hxx>
#include <tools/vcompat.hxx>
@@ -1310,24 +1312,24 @@ SvStream& GalleryTheme::WriteData( SvStream& rOStm ) const
else
{
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
- aPath = aPath.copy( 0, aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() );
+ aPath = aPath.copy( 0, std::min(aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
bRel = aPath == aRelURL1.GetMainURL( INetURLObject::NO_DECODE );
if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) )
{
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
- aPath = aPath.copy( aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() );
+ aPath = aPath.copy( std::min(aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
}
else
{
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
- aPath = aPath.copy( 0, aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() );
+ aPath = aPath.copy( 0, std::min(aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
bRel = aPath == aRelURL2.GetMainURL( INetURLObject::NO_DECODE );
if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) )
{
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
- aPath = aPath.copy( aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() );
+ aPath = aPath.copy( std::min(aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
}
else
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
More information about the Libreoffice-commits
mailing list