[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - sc/source

[Caolán McNamara]

 sc/source/filter/excel/xiescher.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 5e314dfb058990a78cd9e1b9045ac0f186de7003
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jan 21 16:07:46 2017 +0000

    coverity#1399031 golden, Out-of-bounds read
    
    There are 17 elements, so SAL_N_ELEMENTS(sppnPatterns) is 17 The largest valid
    index is 16, not 17, so valid max index is out by one
    
    Change-Id: Id20218a0e73cb9e502a631fa6bfbb3f0a22c4727
    (cherry picked from commit 9ad08b403be9c6646cda9a379332545c3668975b)
    Reviewed-on: https://gerrit.libreoffice.org/33401
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>

diff --git a/sc/source/filter/excel/xiescher.cxx b/sc/source/filter/excel/xiescher.cxx
index 27139cc..1236eea 100644
--- a/sc/source/filter/excel/xiescher.cxx
+++ b/sc/source/filter/excel/xiescher.cxx
@@ -701,7 +701,7 @@ void XclImpDrawObjBase::ConvertFillStyle( SdrObject& rSdrObj, const XclObjFillDa
                 { 0x88, 0x00, 0x22, 0x00, 0x88, 0x00, 0x22, 0x00 },
                 { 0x80, 0x00, 0x08, 0x00, 0x80, 0x00, 0x08, 0x00 }
             };
-            const sal_uInt8* const pnPattern = sppnPatterns[ ::std::min< size_t >( rFillData.mnPattern - 2, SAL_N_ELEMENTS( sppnPatterns ) ) ];
+            const sal_uInt8* const pnPattern = sppnPatterns[std::min<size_t>(rFillData.mnPattern - 2, SAL_N_ELEMENTS(sppnPatterns) - 1)];
             // create 2-colored 8x8 DIB
             SvMemoryStream aMemStrm;
             aMemStrm.WriteUInt32( 12 ).WriteInt16( 8 ).WriteInt16( 8 ).WriteUInt16( 1 ).WriteUInt16( 1 );