[Libreoffice-commits] libvisio.git: src/lib

[David Tardon]

 src/lib/VSDContentCollector.cpp |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 6ba35e73d071dd396fc919e09daa09151354cb95
Author: David Tardon <dtardon at redhat.com>
Date:   Mon Oct 30 14:29:18 2017 +0100

    ofz#3711 band-aid for OOB access in NURBS
    
    Change-Id: Ied73be7f36bd070a38c13243dd851d0bcd4056a3

diff --git a/src/lib/VSDContentCollector.cpp b/src/lib/VSDContentCollector.cpp
index c842852..2ce80e9 100644
--- a/src/lib/VSDContentCollector.cpp
+++ b/src/lib/VSDContentCollector.cpp
@@ -1983,7 +1983,11 @@ void libvisio::VSDContentCollector::_generateBezierSegmentsFromNURBS(unsigned de
       double numer = knotVector[b] - knotVector[a];
       unsigned j = degree;
       std::vector<double> alphas(degree - 1, 0.0);
-      for (; j >mult; j--)
+      // TODO: The second part of the end condition should not be
+      // necessary, but for some reason it can happen. I'm still
+      // convinced there is an inherent off-by-one bug in our impl. of
+      // the algorithm somewhere...
+      for (; j >mult && j < knotVector.size() - a; j--)
         alphas[j-mult-1] = numer/(knotVector[a+j]-knotVector[a]);
       unsigned r = degree - mult;
       for (j=1; j<=r; j++)