svx/source/svdraw/svdoedge.cxx | 5 +++-- sw/source/core/layout/pagechg.cxx | 8 ++++++-- 2 files changed, 9 insertions(+), 4 deletions(-)
New commits: commit 46c1bc239d2f089197bcfe0d296ba745c543feb5 Author: Caolán McNamara <[email protected]> AuthorDate: Sat Oct 19 19:46:04 2024 +0100 Commit: Caolán McNamara <[email protected]> CommitDate: Sun Oct 20 15:37:33 2024 +0200 cid#1606920 Overflowed integer argument Change-Id: I6fc6a12e611a974e8feaecd398242226ab9ad930 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/175246 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> diff --git a/svx/source/svdraw/svdoedge.cxx b/svx/source/svdraw/svdoedge.cxx index 57e47cf8a23c..44ad75fa0cce 100644 --- a/svx/source/svdraw/svdoedge.cxx +++ b/svx/source/svdraw/svdoedge.cxx @@ -1273,9 +1273,10 @@ XPolygon SdrEdgeObj::ImpCalcEdgeTrack(const Point& rPt1, tools::Long nAngle1, co XPolygon aXP2(ImpCalcObjToCenter(aPt2,nAngle2,aBewareRect2,aMeeting)); sal_uInt16 nXP1Cnt=aXP1.GetPointCount(); sal_uInt16 nXP2Cnt=aXP2.GetPointCount(); + assert(nXP1Cnt >= 2 && nXP2Cnt >= 2 && "ImpCalcObjToCenter inserts a min of 2 points"); if (pInfo) { - pInfo->m_nObj1Lines=nXP1Cnt; if (nXP1Cnt>1) pInfo->m_nObj1Lines--; - pInfo->m_nObj2Lines=nXP2Cnt; if (nXP2Cnt>1) pInfo->m_nObj2Lines--; + pInfo->m_nObj1Lines=nXP1Cnt; pInfo->m_nObj1Lines--; + pInfo->m_nObj2Lines=nXP2Cnt; pInfo->m_nObj2Lines--; } Point aEP1(aXP1[nXP1Cnt-1]); Point aEP2(aXP2[nXP2Cnt-1]); commit d28365ecd2cc4e97eff56d01fa163be0852ec016 Author: Caolán McNamara <[email protected]> AuthorDate: Sat Oct 19 19:35:26 2024 +0100 Commit: Caolán McNamara <[email protected]> CommitDate: Sun Oct 20 15:37:21 2024 +0200 cid#1607805 Overflowed constant Change-Id: I14c02ef847f4cc2ab17fa6efb1a4d8c92c585eeb Reviewed-on: https://gerrit.libreoffice.org/c/core/+/175245 Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Jenkins diff --git a/sw/source/core/layout/pagechg.cxx b/sw/source/core/layout/pagechg.cxx index 1c49d6d2b8e5..1c5d112dec72 100644 --- a/sw/source/core/layout/pagechg.cxx +++ b/sw/source/core/layout/pagechg.cxx @@ -410,7 +410,8 @@ static void lcl_FormatLay( SwLayoutFrame *pLay ) static void lcl_MakeObjs(const sw::FrameFormats<sw::SpzFrameFormat*>& rSpzs, SwPageFrame* pPage) { // formats are in the special table of the document - for(size_t i = 0; i < rSpzs.size(); ++i ) + size_t i = 0; + while (i < rSpzs.size()) { auto pSpz = rSpzs[i]; const SwFormatAnchor &rAnch = pSpz->GetAnchor(); @@ -425,7 +426,10 @@ static void lcl_MakeObjs(const sw::FrameFormats<sw::SpzFrameFormat*>& rSpzs, SwP pSpz->SetFormatAttr( aAnch ); } else + { + ++i; continue; + } } // is it a border or a SdrObject? @@ -435,7 +439,6 @@ static void lcl_MakeObjs(const sw::FrameFormats<sw::SpzFrameFormat*>& rSpzs, SwP { OSL_FAIL( "DrawObject not found." ); pSpz->GetDoc()->DelFrameFormat( pSpz ); - --i; continue; } // The object might be anchored to another page, e.g. when inserting @@ -479,6 +482,7 @@ static void lcl_MakeObjs(const sw::FrameFormats<sw::SpzFrameFormat*>& rSpzs, SwP ::RegistFlys( pPg, pFly ); } } + ++i; } }
