chart2/source/tools/ExplicitCategoriesProvider.cxx | 24 +++++++++++++-------- 1 file changed, 15 insertions(+), 9 deletions(-)
New commits: commit 74d1466914547aaa5369f18727c228db9ce88121 Author: Eike Rathke <er...@redhat.com> Date: Tue Feb 19 19:22:27 2013 +0100 do not access vector elements beyond size, rhbz#847519 related The actual bug (crash) is not triggered anymore because the categories are assembled differently, nevertheless the code in question could expose the same behavior under different preconditions. Change-Id: Ic37f6b34effaf4e5252e80aab46b021547b36efb (cherry picked from commit d1ba2cd612a4c39976e2980c7dc4e3fa38c88470) Reviewed-on: https://gerrit.libreoffice.org/2272 Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/chart2/source/tools/ExplicitCategoriesProvider.cxx b/chart2/source/tools/ExplicitCategoriesProvider.cxx index e3d800f..00b481c 100644 --- a/chart2/source/tools/ExplicitCategoriesProvider.cxx +++ b/chart2/source/tools/ExplicitCategoriesProvider.cxx @@ -353,11 +353,14 @@ Sequence< OUString > lcl_getExplicitSimpleCategories( } for( aOuterIt=rComplexCats.begin(); aOuterIt != aOuterEnd; ++aOuterIt ) { - sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt ); - if( nCurrentCount< nMaxCategoryCount ) + if ( !aOuterIt->empty() ) { - ComplexCategory& rComplexCategory = aOuterIt->back(); - rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount); + sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt ); + if( nCurrentCount< nMaxCategoryCount ) + { + ComplexCategory& rComplexCategory = aOuterIt->back(); + rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount); + } } } } @@ -389,12 +392,15 @@ Sequence< OUString > lcl_getExplicitSimpleCategories( OUString aText; for( aOuterIt=aComplexCatsPerIndex.begin() ; aOuterIt != aOuterEnd; ++aOuterIt ) { - OUString aAddText = (*aOuterIt)[nN].Text; - if( !aAddText.isEmpty() ) + if ( static_cast<size_t>(nN) < aOuterIt->size() ) { - if(!aText.isEmpty()) - aText += aSpace; - aText += aAddText; + OUString aAddText = (*aOuterIt)[nN].Text; + if( !aAddText.isEmpty() ) + { + if(!aText.isEmpty()) + aText += aSpace; + aText += aAddText; + } } } aRet[nN]=aText;
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits