[Libreoffice-commits] core.git: editeng/source

[Caolán McNamara (via logerrit)]

 editeng/source/rtf/svxrtf.cxx |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 47da5a7e95ef45efcc9e13f225273e728d1fbc58
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Oct 11 20:20:34 2020 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Mon Oct 12 09:48:06 2020 +0200

    ofz#24932 collatoral ubsan failure seen in TimeOut case
    
    unsigned integer overflow: 0 - 1 cannot be represented in type size_t
    
    Change-Id: Iba74ce28752e4024e0921f91f28866fd9eaf248e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104195
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index a5c1217ff3e7..affc44b8f5f2 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -1085,7 +1085,8 @@ void SvxRTFItemStackType::Compress( const SvxRTFParser& rParser )
     // It can be merged
     aAttrSet.Put( aMrgSet );
 
-    for (size_t n = 0; n < m_pChildList->size(); ++n)
+    size_t n = 0, nChildLen = m_pChildList->size();
+    while (n < nChildLen)
     {
         pTmp = (*m_pChildList)[n].get();
         pTmp->aAttrSet.Differentiate( aMrgSet );
@@ -1093,8 +1094,10 @@ void SvxRTFItemStackType::Compress( const SvxRTFParser& rParser )
         if (!pTmp->m_pChildList && !pTmp->aAttrSet.Count() && !pTmp->nStyleNo)
         {
             m_pChildList->erase( m_pChildList->begin() + n );
-            --n;
+            --nChildLen;
+            continue;
         }
+        ++n;
     }
     if (m_pChildList->empty())
     {