[PATCH libreoffice-4-0] Fix out-of-bonds Sequence access in NumberingManager with pa...

[Fridrich Strba (via Code Review)]

Hi,

I have submitted a patch for review:

    https://gerrit.libreoffice.org/3739

To pull it, you can do:

    git pull ssh://gerrit.libreoffice.org:29418/core refs/changes/39/3739/1

Fix out-of-bonds Sequence access in NumberingManager with page numbering

Change-Id: Ib35fcee1605215fb22ae9838b29fe1d8be5eaf58
(cherry picked from commit 4314e6548356a5d2f1dc45e2aa501e37bd5a794e)
---
M writerfilter/source/dmapper/NumberingManager.cxx
1 file changed, 2 insertions(+), 1 deletion(-)



diff --git a/writerfilter/source/dmapper/NumberingManager.cxx b/writerfilter/source/dmapper/NumberingManager.cxx
index 470cb0c..0cd9138 100644
--- a/writerfilter/source/dmapper/NumberingManager.cxx
+++ b/writerfilter/source/dmapper/NumberingManager.cxx
@@ -492,7 +492,8 @@
 
     // Merge the results of [2] in [1]
     sal_Int32 nThisCount = aThis.getLength( );
-    for ( sal_Int32 i = 0; i < nThisCount; i++ )
+    sal_Int32 nAbstractCount = aAbstract.getLength( );
+    for ( sal_Int32 i = 0; i < nThisCount && i < nAbstractCount; i++ )
     {
         uno::Sequence< beans::PropertyValue > level = aThis[i];
         if ( level.hasElements() )

-- 
To view, visit https://gerrit.libreoffice.org/3739
To unsubscribe, visit https://gerrit.libreoffice.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ib35fcee1605215fb22ae9838b29fe1d8be5eaf58
Gerrit-PatchSet: 1
Gerrit-Project: core
Gerrit-Branch: libreoffice-4-0
Gerrit-Owner: Fridrich Strba <fridrich at documentfoundation.org>