[Libreoffice-commits] core.git: 2 commits - connectivity/source sw/source

[Caolán McNamara]

 connectivity/source/drivers/dbase/dindexnode.cxx |    1 +
 sw/source/filter/ww8/ww8scan.cxx                 |    3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

New commits:
commit 8ceb8b2d141a249127822bd511e66dd855fb1e59
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Nov 24 11:43:38 2016 +0000

    Related: coverity#1371267 copy ctor broken, nPagePos not copied
    
    initially operator= was removed by
    
    commit a0a919d2b541c415ad9b81d2ee91895bf106e9bb
    Date:   Fri Oct 3 10:39:28 2014 +0200
    
        remove SvRefBase::QueryDelete
    
    and then operator= was restored by
    
    commit faa6455995966e41653204779d055b885b27fc4c
    Date:   Fri Oct 10 12:02:32 2014 +0200
    
        add copy constructor for ONDXPagePtr class
    
        which I forgot in commit a0a919d2b541c415ad9b81d2ee91895bf106e9bb
        "remove SvRefBase::QueryDelete"
    
    but nPagePos was missed
    
    Change-Id: I6497934d4a199f5ea94cf2da840c164910e7a826

diff --git a/connectivity/source/drivers/dbase/dindexnode.cxx b/connectivity/source/drivers/dbase/dindexnode.cxx
index 064660b..7790f74 100644
--- a/connectivity/source/drivers/dbase/dindexnode.cxx
+++ b/connectivity/source/drivers/dbase/dindexnode.cxx
@@ -858,6 +858,7 @@ ONDXPagePtr& ONDXPagePtr::operator=(ONDXPagePtr const & rOther)
     }
     ONDXPage * pOldObj = mpPage;
     mpPage = rOther.mpPage;
+    nPagePos = rOther.nPagePos;
     if (pOldObj != nullptr) {
         pOldObj->ReleaseRef();
     }
commit 9868cfb58ae833b54b671bb7a81db33b845251ac
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Nov 24 10:04:24 2016 +0000

    coverity#1394416 ensure there's enough data to read
    
    an alternative attempt to silence coverity
    
    Change-Id: Ia62d1c9075ecee1657554a5f0705fc67656848fd

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index b2a1fe3..8b27a3f 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2550,7 +2550,8 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(const WW8Fib& rFib, SvStream* pSt,
                          of the new data
                         */
                         bool bExpand = IsExpandableSprm(nSpId);
-                        if ((IsReplaceAllSprm(nSpId) || bExpand) && aEntry.mnLen >= sizeof(sal_uInt32) + 2)
+                        const void* pEndAvailableData = maRawData + sizeof(maRawData);
+                        if ((IsReplaceAllSprm(nSpId) || bExpand) && aEntry.mpData + 2 + sizeof(sal_uInt32) <= pEndAvailableData)
                         {
                             sal_uInt32 nCurr = pDataSt->Tell();
                             sal_uInt32 nPos = SVBT32ToUInt32(aEntry.mpData + 2);