[Libreoffice-commits] core.git: Branch 'libreoffice-6-1' - winaccessibility/source

[Libreoffice Gerrit user]

 winaccessibility/source/UAccCOM/MAccessible.cxx |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 112d0b9121c922dbc3d0fc7ef99749119499b5d4
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Oct 19 17:22:42 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Oct 26 21:59:57 2018 +0200

    pvs-studio: 'memcpy' function will lead to underflow of the buffer
    
    Change-Id: I285d5ddcc8906d1e38c6b58c625dc7c894ad433a
    Reviewed-on: https://gerrit.libreoffice.org/62085
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>

diff --git a/winaccessibility/source/UAccCOM/MAccessible.cxx b/winaccessibility/source/UAccCOM/MAccessible.cxx
index 279fd6ad1e00..25c86411f4f6 100644
--- a/winaccessibility/source/UAccCOM/MAccessible.cxx
+++ b/winaccessibility/source/UAccCOM/MAccessible.cxx
@@ -2901,10 +2901,13 @@ void CMAccessible::ConvertAnyToVariant(const css::uno::Any &rAnyVal, VARIANT *pv
             break;
 
         case TypeClass_BOOLEAN:
+        {
+            bool bBoolean(false);
+            rAnyVal >>= bBoolean;
             pvData->vt = VT_BOOL;
-            memcpy(&pvData->boolVal, rAnyVal.getValue(), sizeof(sal_Bool));
+            pvData->boolVal = bBoolean; // boolVal is a VARIANT_BOOL, a 16bit field
             break;
-
+        }
         case TypeClass_BYTE:
             pvData->vt = VT_UI1;
             memcpy(&pvData->bVal, rAnyVal.getValue(), sizeof(sal_Int8));