diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2020-10-11 20:20:34 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2020-10-12 09:48:06 +0200 |
| commit | 47da5a7e95ef45efcc9e13f225273e728d1fbc58 (patch) | |
| tree | bd1e106b1456cc4ef11e91e8d4536b815523d873 /editeng | |
| parent | 7ddb7d30d44008f5873d20dbcd11a1afd46a3ec5 (diff) | |
ofz#24932 collatoral ubsan failure seen in TimeOut case
unsigned integer overflow: 0 - 1 cannot be represented in type size_t
Change-Id: Iba74ce28752e4024e0921f91f28866fd9eaf248e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104195
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'editeng')
| -rw-r--r-- | editeng/source/rtf/svxrtf.cxx | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx index a5c1217ff3e7..affc44b8f5f2 100644 --- a/editeng/source/rtf/svxrtf.cxx +++ b/editeng/source/rtf/svxrtf.cxx @@ -1085,7 +1085,8 @@ void SvxRTFItemStackType::Compress( const SvxRTFParser& rParser ) // It can be merged aAttrSet.Put( aMrgSet ); - for (size_t n = 0; n < m_pChildList->size(); ++n) + size_t n = 0, nChildLen = m_pChildList->size(); + while (n < nChildLen) { pTmp = (*m_pChildList)[n].get(); pTmp->aAttrSet.Differentiate( aMrgSet ); @@ -1093,8 +1094,10 @@ void SvxRTFItemStackType::Compress( const SvxRTFParser& rParser ) if (!pTmp->m_pChildList && !pTmp->aAttrSet.Count() && !pTmp->nStyleNo) { m_pChildList->erase( m_pChildList->begin() + n ); - --n; + --nChildLen; + continue; } + ++n; } if (m_pChildList->empty()) { |