editeng/source/rtf/svxrtf.cxx | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
New commits:
commit 47da5a7e95ef45efcc9e13f225273e728d1fbc58
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Oct 11 20:20:34 2020 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Mon Oct 12 09:48:06 2020 +0200
ofz#24932 collatoral ubsan failure seen in TimeOut case
unsigned integer overflow: 0 - 1 cannot be represented in type size_t
Change-Id: Iba74ce28752e4024e0921f91f28866fd9eaf248e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104195
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index a5c1217ff3e7..affc44b8f5f2 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -1085,7 +1085,8 @@ void SvxRTFItemStackType::Compress( const SvxRTFParser&
rParser )
// It can be merged
aAttrSet.Put( aMrgSet );
- for (size_t n = 0; n < m_pChildList->size(); ++n)
+ size_t n = 0, nChildLen = m_pChildList->size();
+ while (n < nChildLen)
{
pTmp = (*m_pChildList)[n].get();
pTmp->aAttrSet.Differentiate( aMrgSet );
@@ -1093,8 +1094,10 @@ void SvxRTFItemStackType::Compress( const SvxRTFParser&
rParser )
if (!pTmp->m_pChildList && !pTmp->aAttrSet.Count() && !pTmp->nStyleNo)
{
m_pChildList->erase( m_pChildList->begin() + n );
- --n;
+ --nChildLen;
+ continue;
}
+ ++n;
}
if (m_pChildList->empty())
{
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
