#i122752# check iterator in each iteration of CFormatEtcContainer::nextFormatEtc()'s loop

Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator beyond
the container bounds. The comparable loop in CFormatEtcContainer::skipFormatEtc()
already checks the iterator against the container end in each iteration.

1 files changed, 4 insertions, 3 deletions

diff --git a/dtrans/source/win32/dtobj/FetcList.cxx b/dtrans/source/win32/dtobj/FetcList.cxx
index 531ae38be14a..ca455dc9ca4f 100644
--- a/dtrans/source/win32/dtobj/FetcList.cxx
+++ b/dtrans/source/win32/dtobj/FetcList.cxx
@@ -143,10 +143,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer::nextFormatEtc( LPFORMATETC lpFetc,
 
     sal_uInt32 nFetched = 0;
 
-    if ( m_EnumIterator != m_FormatMap.end( ) )
+    for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
     {
-        for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
-            CopyFormatEtc( lpFetc, *m_EnumIterator );
+        if ( m_EnumIterator == m_FormatMap.end() )
+            break;
+        CopyFormatEtc( lpFetc, *m_EnumIterator );
     }
 
     return nFetched;