svn commit: r1586681 - /openoffice/trunk/main/filter/source/msfilter/escherex.cxx

[alg]

Author: alg
Date: Fri Apr 11 15:29:35 2014
New Revision: 1586681

URL: http://svn.apache.org/r1586681
Log:
i124661 secure possible out of bound access to stl vector content

Modified:
    openoffice/trunk/main/filter/source/msfilter/escherex.cxx

Modified: openoffice/trunk/main/filter/source/msfilter/escherex.cxx
URL: 
http://svn.apache.org/viewvc/openoffice/trunk/main/filter/source/msfilter/escherex.cxx?rev=1586681&r1=1586680&r2=1586681&view=diff
==============================================================================
--- openoffice/trunk/main/filter/source/msfilter/escherex.cxx (original)
+++ openoffice/trunk/main/filter/source/msfilter/escherex.cxx Fri Apr 11 
15:29:35 2014
@@ -2604,7 +2604,18 @@ void ConvertEnhancedCustomShapeEquation(
                                        if ( aIter->nOperation & nMask )
                                        {
                                                aIter->nOperation ^= nMask;
-                                               aIter->nPara[ i ] = 
rEquationOrder[ aIter->nPara[ i ] & 0x3ff ] | 0x400;
+                        const sal_Int32 nIndex(aIter->nPara[ i ] & 0x3ff);
+
+                        // #124661# check index access, there are cases where 
this is out of bound leading
+                        // to errors up to crashes when executed
+                        if(nIndex < rEquationOrder.size())
+                        {
+                            aIter->nPara[ i ] = rEquationOrder[ nIndex ] | 
0x400;
+                        }
+                        else
+                        {
+                            OSL_ENSURE(false, "Attempted out of bound access 
to rEquationOrder of CustomShape (!)");
+                        }
                                        }
                                        nMask <<= 1;
                                }