27aea6
From ce58f18222a7b20e02bb5b3b8b328b11b1c29a31 Mon Sep 17 00:00:00 2001
27aea6
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
27aea6
Date: Fri, 9 Feb 2018 10:49:39 +0000
27aea6
Subject: [PATCH] ofz#6173 check index before use
27aea6
MIME-Version: 1.0
27aea6
Content-Type: text/plain; charset=UTF-8
27aea6
Content-Transfer-Encoding: 8bit
27aea6
27aea6
Change-Id: I09d15ab324af0a8b3566f11868eb3266a68c4afe
27aea6
Reviewed-on: https://gerrit.libreoffice.org/49486
27aea6
Tested-by: Jenkins <ci@libreoffice.org>
27aea6
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
27aea6
Tested-by: Caolán McNamara <caolanm@redhat.com>
27aea6
---
27aea6
 sw/source/filter/ww8/ww8toolbar.cxx | 4 +++-
27aea6
 1 file changed, 3 insertions(+), 1 deletion(-)
27aea6
27aea6
diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
27aea6
index 15c0abb..3686a73 100644
27aea6
--- a/sw/source/filter/ww8/ww8toolbar.cxx
27aea6
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
27aea6
@@ -167,7 +167,9 @@ bool SwCTBWrapper::Read( SvStream& rS )
27aea6
     std::vector< sal_Int16 >::iterator it_end = dropDownMenuIndices.end();
27aea6
     for ( std::vector< sal_Int16 >::iterator it = dropDownMenuIndices.begin(); it != it_end; ++it )
27aea6
     {
27aea6
-        rCustomizations[ *it ].bIsDroppedMenuTB = true;
27aea6
+        if (*it < 0 || static_cast<size_t>(*it) >= rCustomizations.size())
27aea6
+            continue;
27aea6
+        rCustomizations[*it].bIsDroppedMenuTB = true;
27aea6
     }
27aea6
     return rS.good();
27aea6
 }
27aea6
-- 
27aea6
2.14.3
27aea6