diff options
| author | Caolán McNamara <caolan.mcnamara@collabora.com> | 2023-06-14 15:37:08 +0100 |
|---|---|---|
| committer | Henry Castro <hcastro@collabora.com> | 2023-06-15 22:42:51 +0200 |
| commit | 631f99be735735fd3422516441f18bff7782972c (patch) | |
| tree | 2359691a2ce5364af67ab71e85adb23b15aa812f | |
| parent | backport CVE-2023-1999 libwebp fix (diff) | |
| download | core-631f99be735735fd3422516441f18bff7782972c.tar.gz core-631f99be735735fd3422516441f18bff7782972c.zip | |
cid#1532384 Out-of-bounds read
sizeof returns num of bytes, not num of elements
Change-Id: I9dea109e5f322d93ee10680f120b15554efa92e1
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153070
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Henry Castro <hcastro@collabora.com>
| -rw-r--r-- | sc/source/filter/oox/condformatbuffer.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sc/source/filter/oox/condformatbuffer.cxx b/sc/source/filter/oox/condformatbuffer.cxx index 568a4197b070..7dfc73a4ca7c 100644 --- a/sc/source/filter/oox/condformatbuffer.cxx +++ b/sc/source/filter/oox/condformatbuffer.cxx @@ -265,7 +265,7 @@ static ::Color IndexedColors[] = { else if (rAttribs.hasAttribute(XML_indexed)) { sal_uInt32 nIndexed = rAttribs.getUnsigned(XML_indexed, 0); - if (nIndexed < sizeof(IndexedColors)) + if (nIndexed < std::size(IndexedColors)) nColor = IndexedColors[nIndexed]; } |