tools/source/stream/stream.cxx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
New commits: commit 9ff0df208be033eef449b7bb35d5dc4d4b335231 Author: Noel Grandin <[email protected]> AuthorDate: Thu Feb 26 10:57:42 2026 +0200 Commit: Noel Grandin <[email protected]> CommitDate: Thu Feb 26 13:50:59 2026 +0100 fix pointer arithmetic in SvMemoryStream::PutData after commit fa002b6244207ff2bb92f7e714d56c4e2b103064 Author: Noel Grandin <[email protected]> Date: Sat Feb 21 21:00:32 2026 +0200 fix asan heap-use-after-free Change-Id: I2ed04d2957089f2e6968ac63b14639e27709295c Reviewed-on: https://gerrit.libreoffice.org/c/core/+/200400 Reviewed-by: Noel Grandin <[email protected]> Tested-by: Noel Grandin <[email protected]> diff --git a/tools/source/stream/stream.cxx b/tools/source/stream/stream.cxx index 77d06abfe0fd..01c33a3ab534 100644 --- a/tools/source/stream/stream.cxx +++ b/tools/source/stream/stream.cxx @@ -1646,7 +1646,7 @@ std::size_t SvMemoryStream::PutData( const void* pData, std::size_t nCount ) } else { - const bool bSourceDataIsInsideBuffer = pData >= pBuf && pData <= (pBuf + nSize); + const bool bSourceDataIsInsideBuffer = pData >= pBuf && pData < (pBuf + nSize); std::ptrdiff_t const offset = bSourceDataIsInsideBuffer ? static_cast<const char*>(pData) - reinterpret_cast<const char*>(pBuf) : 0; tools::Long nNewResize; if( nSize && nSize > nResize )
