diff options
| author | Eike Rathke <erack@redhat.com> | 2013-02-19 19:22:27 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2013-02-19 22:42:02 +0100 |
| commit | d1ba2cd612a4c39976e2980c7dc4e3fa38c88470 (patch) | |
| tree | eda46a672f2eac04d277d1b8ab47783d3a306180 /chart2 | |
| parent | ef3fb927977681c3e5b5160e961e240063a8cb70 (diff) | |
do not access vector elements beyond size, rhbz#847519 related
The actual bug (crash) is not triggered anymore because the categories
are assembled differently, nevertheless the code in question could
expose the same behavior under different preconditions.
Change-Id: Ic37f6b34effaf4e5252e80aab46b021547b36efb
Diffstat (limited to 'chart2')
| -rw-r--r-- | chart2/source/tools/ExplicitCategoriesProvider.cxx | 24 |
1 files changed, 15 insertions, 9 deletions
diff --git a/chart2/source/tools/ExplicitCategoriesProvider.cxx b/chart2/source/tools/ExplicitCategoriesProvider.cxx index b1a52555b8e0..538a9d0dad80 100644 --- a/chart2/source/tools/ExplicitCategoriesProvider.cxx +++ b/chart2/source/tools/ExplicitCategoriesProvider.cxx @@ -353,11 +353,14 @@ Sequence< OUString > lcl_getExplicitSimpleCategories( } for( aOuterIt=rComplexCats.begin(); aOuterIt != aOuterEnd; ++aOuterIt ) { - sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt ); - if( nCurrentCount< nMaxCategoryCount ) + if ( !aOuterIt->empty() ) { - ComplexCategory& rComplexCategory = aOuterIt->back(); - rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount); + sal_Int32 nCurrentCount = lcl_getCategoryCount( *aOuterIt ); + if( nCurrentCount< nMaxCategoryCount ) + { + ComplexCategory& rComplexCategory = aOuterIt->back(); + rComplexCategory.Count += (nMaxCategoryCount-nCurrentCount); + } } } } @@ -389,12 +392,15 @@ Sequence< OUString > lcl_getExplicitSimpleCategories( OUString aText; for( aOuterIt=aComplexCatsPerIndex.begin() ; aOuterIt != aOuterEnd; ++aOuterIt ) { - OUString aAddText = (*aOuterIt)[nN].Text; - if( !aAddText.isEmpty() ) + if ( static_cast<size_t>(nN) < aOuterIt->size() ) { - if(!aText.isEmpty()) - aText += aSpace; - aText += aAddText; + OUString aAddText = (*aOuterIt)[nN].Text; + if( !aAddText.isEmpty() ) + { + if(!aText.isEmpty()) + aText += aSpace; + aText += aAddText; + } } } aRet[nN]=aText; |