Kaydet (Commit) 6b3b080f authored tarafından Armin Le Grand's avatar Armin Le Grand Kaydeden (comit) Caolán McNamara

tdf#95298: corrected some out-of-bound accesses to array

the index variable m_FrameList used to reference the current frame uses
the state EMTY_FRAMELIST to mark as invalid, which is the max integer
number. Thus all usages have to be secured to not use m_FrameList
if set to EMPTY_FRAMELIST. This was missing in some places.
the max integer
number. Thus all usages have to be secured to not use m_FrameList
if set to EMPTY_FRAMELIST. This was missing in some places.

Reviewed-on: https://gerrit.libreoffice.org/19753Tested-by: 's avatarJenkins <ci@libreoffice.org>
Reviewed-by: 's avatarKatarina Behrens <Katarina.Behrens@cib.de>

Cherry-picked from f0cef70c

Change-Id: Ie1cf4ae2cb79d821f634ec78b621a2647abc61a8
Reviewed-on: https://gerrit.libreoffice.org/19787Tested-by: 's avatarJenkins <ci@libreoffice.org>
Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
üst c7a52086
...@@ -430,7 +430,8 @@ IMPL_LINK( AnimationWindow, ClickRemoveBitmapHdl, void *, pBtn ) ...@@ -430,7 +430,8 @@ IMPL_LINK( AnimationWindow, ClickRemoveBitmapHdl, void *, pBtn )
SdPage* pPage = pMyDoc->GetSdPage(0, PK_STANDARD); SdPage* pPage = pMyDoc->GetSdPage(0, PK_STANDARD);
SdrObject* pObject; SdrObject* pObject;
if (pBtn == m_pBtnRemoveBitmap) // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access
if (pBtn == m_pBtnRemoveBitmap && EMPTY_FRAMELIST != m_nCurrentFrame)
{ {
delete m_FrameList[m_nCurrentFrame].first; delete m_FrameList[m_nCurrentFrame].first;
delete m_FrameList[m_nCurrentFrame].second; delete m_FrameList[m_nCurrentFrame].second;
...@@ -449,8 +450,8 @@ IMPL_LINK( AnimationWindow, ClickRemoveBitmapHdl, void *, pBtn ) ...@@ -449,8 +450,8 @@ IMPL_LINK( AnimationWindow, ClickRemoveBitmapHdl, void *, pBtn )
if (m_nCurrentFrame >= m_FrameList.size()) if (m_nCurrentFrame >= m_FrameList.size())
{ {
assert(m_FrameList.empty()); // tdf#95298 last frame was deleted, try to use the one before it or go on empty state
m_nCurrentFrame = EMPTY_FRAMELIST; m_nCurrentFrame = m_FrameList.empty() ? EMPTY_FRAMELIST : m_FrameList.size() - 1;
} }
} }
else // delete everything else // delete everything
...@@ -539,7 +540,8 @@ IMPL_LINK_NOARG(AnimationWindow, ModifyTimeHdl) ...@@ -539,7 +540,8 @@ IMPL_LINK_NOARG(AnimationWindow, ModifyTimeHdl)
void AnimationWindow::UpdateControl(bool const bDisableCtrls) void AnimationWindow::UpdateControl(bool const bDisableCtrls)
{ {
if (!m_FrameList.empty()) // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access
if (!m_FrameList.empty() && EMPTY_FRAMELIST != m_nCurrentFrame)
{ {
BitmapEx aBmp(*m_FrameList[m_nCurrentFrame].first); BitmapEx aBmp(*m_FrameList[m_nCurrentFrame].first);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment