filter/source/msfilter/escherex.cxx | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
New commits: commit c9cdd9751d45b5b8b0288e9dc477e6d272ba0a0d Author: Armin Le Grand <a...@apache.org> Date: Fri Apr 11 15:29:35 2014 +0000 i124661 secure possible out of bound access to stl vector content diff --git a/filter/source/msfilter/escherex.cxx b/filter/source/msfilter/escherex.cxx index 28932a0..3df2193 100644 --- a/filter/source/msfilter/escherex.cxx +++ b/filter/source/msfilter/escherex.cxx @@ -2604,7 +2604,18 @@ void ConvertEnhancedCustomShapeEquation( SdrObjCustomShape* pCustoShape, if ( aIter->nOperation & nMask ) { aIter->nOperation ^= nMask; - aIter->nPara[ i ] = rEquationOrder[ aIter->nPara[ i ] & 0x3ff ] | 0x400; + const sal_Int32 nIndex(aIter->nPara[ i ] & 0x3ff); + + // #124661# check index access, there are cases where this is out of bound leading + // to errors up to crashes when executed + if(nIndex < rEquationOrder.size()) + { + aIter->nPara[ i ] = rEquationOrder[ nIndex ] | 0x400; + } + else + { + OSL_ENSURE(false, "Attempted out of bound access to rEquationOrder of CustomShape (!)"); + } } nMask <<= 1; } _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits