commit c744dac16ad808c73021cb2cecefe1d484934451
author Mike Kaganski <mike.kaganski@collabora.com> Fri Jun 07 21:02:19 2019 +1000
committer Mike Kaganski <mike.kaganski@collabora.com> Sat Jun 08 03:53:00 2019 +0200
tree cee4dc3e9b2c598fca97021601671c282d87adc1
parent 8bb5da0d676cfe041dcb2ffe41a1f9cd35697510

tdf#125624: this bugdoc overflows sal_uInt16

Change-Id: I8ecc08d3ef42b9f7cc501017e0e169bde2196317
Reviewed-on: https://gerrit.libreoffice.org/73654
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit 2d5821ceacf399ec9267a3704ee0b2cc8a598f04)
Reviewed-on: https://gerrit.libreoffice.org/73671

sw/source/core/text/atrhndl.hxx

diff --git a/sw/source/core/text/atrhndl.hxx b/sw/source/core/text/atrhndl.hxx
index f12bd76..81a1413 100644
--- a/sw/source/core/text/atrhndl.hxx
+++ b/sw/source/core/text/atrhndl.hxx
@@ -47,8 +47,8 @@ private:
    private:
        SwTextAttr*  m_pInitialArray[ INITIAL_NUM_ATTR ];
        SwTextAttr** m_pArray;
        sal_uInt16 m_nCount; // number of elements on stack
        sal_uInt16 m_nSize;  // number of positions in Array
        sal_uInt32 m_nCount; // number of elements on stack
        sal_uInt32 m_nSize;  // number of positions in Array

    public:
        // Ctor, Dtor
@@ -64,7 +64,7 @@ private:
        void Push( const SwTextAttr& rAttr ) { Insert(rAttr, m_nCount); };
        // insert at specified position, take care for not inserting behind
        // the value returned by Count()
        void Insert( const SwTextAttr& rAttr, const sal_uInt16 nPos );
        void Insert( const SwTextAttr& rAttr, const sal_uInt32 nPos );

        // remove specified attribute
        void Remove( const SwTextAttr& rAttr );
@@ -73,11 +73,11 @@ private:
        const SwTextAttr* Top() const;

        // number of elements on stack
        sal_uInt16 Count() const { return m_nCount; };
        sal_uInt32 Count() const { return m_nCount; };

        // returns position of rAttr on Stack if found, otherwise USHRT_MAX
        // can be used for Remove of an attribute
        sal_uInt16 Pos( const SwTextAttr& rAttr ) const;
        sal_uInt32 Pos( const SwTextAttr& rAttr ) const;
    };

    SwAttrStack m_aAttrStack[ NUM_ATTRIBUTE_STACKS ]; // stack collection

sw/source/core/text/atrstck.cxx

diff --git a/sw/source/core/text/atrstck.cxx b/sw/source/core/text/atrstck.cxx
index 9130208..eb2762f 100644
--- a/sw/source/core/text/atrstck.cxx
+++ b/sw/source/core/text/atrstck.cxx
@@ -270,7 +270,7 @@ inline SwAttrHandler::SwAttrStack::SwAttrStack()
    m_pArray = m_pInitialArray;
}

void SwAttrHandler::SwAttrStack::Insert( const SwTextAttr& rAttr, const sal_uInt16 nPos )
void SwAttrHandler::SwAttrStack::Insert( const SwTextAttr& rAttr, const sal_uInt32 nPos )
{
    // do we still have enough space?
    if (m_nCount >= m_nSize)
@@ -311,7 +311,7 @@ void SwAttrHandler::SwAttrStack::Insert( const SwTextAttr& rAttr, const sal_uInt

void SwAttrHandler::SwAttrStack::Remove( const SwTextAttr& rAttr )
{
    sal_uInt16 nPos = Pos( rAttr );
    sal_uInt32 nPos = Pos( rAttr );
    if (nPos < m_nCount)
    {
        memmove( m_pArray + nPos, m_pArray + nPos + 1,
@@ -326,20 +326,20 @@ const SwTextAttr* SwAttrHandler::SwAttrStack::Top() const
    return m_nCount ? m_pArray[ m_nCount - 1 ] : nullptr;
}

sal_uInt16 SwAttrHandler::SwAttrStack::Pos( const SwTextAttr& rAttr ) const
sal_uInt32 SwAttrHandler::SwAttrStack::Pos( const SwTextAttr& rAttr ) const
{
    if ( ! m_nCount )
        // empty stack
        return USHRT_MAX;
        return std::numeric_limits<sal_uInt32>::max();

    for (sal_uInt16 nIdx = m_nCount; nIdx > 0;)
    for (sal_uInt32 nIdx = m_nCount; nIdx > 0;)
    {
        if (&rAttr == m_pArray[ --nIdx ])
            return nIdx;
    }

    // element not found
    return USHRT_MAX;
    return std::numeric_limits<sal_uInt32>::max();
}

SwAttrHandler::SwAttrHandler()
@@ -487,7 +487,7 @@ bool SwAttrHandler::Push( const SwTextAttr& rAttr, const SfxPoolItem& rItem )
        return true;
    }

    const sal_uInt16 nPos = m_aAttrStack[ nStack ].Count();
    const sal_uInt32 nPos = m_aAttrStack[ nStack ].Count();
    OSL_ENSURE( nPos, "empty stack?" );
    m_aAttrStack[ nStack ].Insert( rAttr, nPos - 1 );
    return false;