strepsirrhini/office-gobmx
9
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tdf#163486: PVS: Array overrun is possible

Browse source 
In both cases, we know nSubSelPos < aSels.size() since it's been tested some lines before

Change-Id: I1e1e7c63f30bf0ea830f050284b5d2af18a597f7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/175673
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
Tested-by: Jenkins
Reviewed-by: Julien Nabet <serval2412@yahoo.fr>
This commit is contained in:
Julien Nabet 2024-10-26 10:46:21 +02:00
parent 1a1d67396c
commit ed425db15b
1 changed files with 3 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
tools/source/memtools/multisel.cxx
View file

@ -217,11 +217,8 @@ bool MultiSelection::Select( sal_Int32 nIndex, bool bSelect )
else
{
// split the sub selection
if ( nSubSelPos < aSels.size() ) {
// we know nSubSelPos < aSels.size() since it's been tested some lines before
aSels.insert( aSels.begin() + nSubSelPos, Range( aSels[ nSubSelPos ].Min(), nIndex-1 ) );
} else {
aSels.push_back( Range( aSels[ nSubSelPos ].Min(), nIndex-1 ) );
}
aSels[ nSubSelPos+1 ].Min() = nIndex + 1;
}
}
@ -323,11 +320,7 @@ void MultiSelection::Insert( sal_Int32 nIndex, sal_Int32 nCount )
if ( aSels[ nSubSelPos ].Min() != nIndex
&& aSels[ nSubSelPos ].Contains(nIndex)
) { // split the sub selection
if ( nSubSelPos < aSels.size() ) {
aSels.insert( aSels.begin() + nSubSelPos, Range( aSels[ nSubSelPos ].Min(), nIndex-1 ) );
} else {
aSels.push_back( Range( aSels[ nSubSelPos ].Min(), nIndex-1 ) );
}
++nSubSelPos;
aSels[ nSubSelPos ].Min() = nIndex;
}