diff options
| author | Stephan Bergmann <sbergman@redhat.com> | 2013-10-21 17:22:47 +0200 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2013-10-21 17:22:47 +0200 |
| commit | 5e18e8c597722f78ef8416dff2295dc08c110ceb (patch) | |
| tree | ec678807c02ced58f78a48d83c8f71c8f282ad20 /svx | |
| parent | be42330ae276219dee5b7ed3c7625f8da6121d1d (diff) | |
Check for OUString::copy out-of-bounds arguments
regression introduced with 1287804a89c73e072d57a11ca18988c3e73a77b8 "convert
svx/source/gallery/*.cxx from String to OUString"
Change-Id: Ia8171f2215253b6db8f7eb1f623a6e0c68dc7b94
Diffstat (limited to 'svx')
| -rw-r--r-- | svx/source/gallery2/galtheme.cxx | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/svx/source/gallery2/galtheme.cxx b/svx/source/gallery2/galtheme.cxx index e8dbea5c1a16..bab0d02ea403 100644 --- a/svx/source/gallery2/galtheme.cxx +++ b/svx/source/gallery2/galtheme.cxx @@ -19,6 +19,8 @@ #include "sal/config.h" +#include <algorithm> + #include <comphelper/processfactory.hxx> #include <tools/urlobj.hxx> #include <tools/vcompat.hxx> @@ -1310,24 +1312,24 @@ SvStream& GalleryTheme::WriteData( SvStream& rOStm ) const else { aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); - aPath = aPath.copy( 0, aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); + aPath = aPath.copy( 0, std::min(aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) ); bRel = aPath == aRelURL1.GetMainURL( INetURLObject::NO_DECODE ); if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) ) { aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); - aPath = aPath.copy( aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); + aPath = aPath.copy( std::min(aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) ); } else { aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); - aPath = aPath.copy( 0, aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); + aPath = aPath.copy( 0, std::min(aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) ); bRel = aPath == aRelURL2.GetMainURL( INetURLObject::NO_DECODE ); if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) ) { aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); - aPath = aPath.copy( aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); + aPath = aPath.copy( std::min(aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) ); } else aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); |