mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for OUString::copy out-of-bounds arguments

Browse Source 
regression introduced with 1287804a89 "convert
svx/source/gallery/*.cxx from String to OUString"

Change-Id: Ia8171f2215253b6db8f7eb1f623a6e0c68dc7b94
This commit is contained in:
Stephan Bergmann
2013-10-21 17:22:47 +02:00
parent be42330ae2
commit 5e18e8c597
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
svx/source/gallery2/galtheme.cxx
View File

@@ -19,6 +19,8 @@
#include "sal/config.h" #include "sal/config.h"
#include <algorithm>
#include <comphelper/processfactory.hxx> #include <comphelper/processfactory.hxx>
#include <tools/urlobj.hxx> #include <tools/urlobj.hxx>
#include <tools/vcompat.hxx> #include <tools/vcompat.hxx>
@@ -1310,24 +1312,24 @@ SvStream& GalleryTheme::WriteData( SvStream& rOStm ) const
else else
{ {
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
aPath = aPath.copy( 0, aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); aPath = aPath.copy( 0, std::min(aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
bRel = aPath == aRelURL1.GetMainURL( INetURLObject::NO_DECODE ); bRel = aPath == aRelURL1.GetMainURL( INetURLObject::NO_DECODE );
if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) ) if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) )
{ {
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
aPath = aPath.copy( aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); aPath = aPath.copy( std::min(aRelURL1.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
} }
else else
{ {
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
aPath = aPath.copy( 0, aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); aPath = aPath.copy( 0, std::min(aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
bRel = aPath == aRelURL2.GetMainURL( INetURLObject::NO_DECODE ); bRel = aPath == aRelURL2.GetMainURL( INetURLObject::NO_DECODE );
if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) ) if( bRel && ( pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ).getLength() > ( aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() + 1 ) ) )
{ {
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );
aPath = aPath.copy( aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength() ); aPath = aPath.copy( std::min(aRelURL2.GetMainURL( INetURLObject::NO_DECODE ).getLength(), aPath.getLength()) );
} }
else else
aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE ); aPath = pObj->aURL.GetMainURL( INetURLObject::NO_DECODE );