Kaydet (Commit) 199ddc1e authored tarafından Herbert Dürr's avatar Herbert Dürr Kaydeden (comit) Caolán McNamara

#i122752# check iterator in each iteration of CFormatEtcContainer::nextFormatEtc()'s loop

Don't trust nextFormatEtc()'s aNum argument not to mislead the iterator beyond
the container bounds. The comparable loop in CFormatEtcContainer::skipFormatEtc()
already checks the iterator against the container end in each iteration.

(cherry picked from commit a609daa1)
üst 7f5faa7f
......@@ -131,10 +131,11 @@ sal_uInt32 SAL_CALL CFormatEtcContainer::nextFormatEtc( LPFORMATETC lpFetc,
sal_uInt32 nFetched = 0;
if ( m_EnumIterator != m_FormatMap.end( ) )
for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
{
for ( sal_uInt32 i = 0; i < aNum; i++, nFetched++, lpFetc++, ++m_EnumIterator )
CopyFormatEtc( lpFetc, *m_EnumIterator );
if ( m_EnumIterator == m_FormatMap.end() )
break;
CopyFormatEtc( lpFetc, *m_EnumIterator );
}
return nFetched;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment