From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 9 Feb 2018 10:49:39 +0000 (+0000)
Subject: ofz#6173 check index before use
X-Git-Tag: archive/raspbian/1%5.2.7-1+rpi1+deb9u11^2~16
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=3149b1a6700128810e152b414c9637273f7a507f;p=libreoffice.git

ofz#6173 check index before use

Change-Id: I09d15ab324af0a8b3566f11868eb3266a68c4afe
Reviewed-on: https://gerrit.libreoffice.org/49486
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

Gbp-Pq: Name CVE-2018-10120.diff
---

diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
index 056839aae6e..abdc9458f21 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -166,7 +166,9 @@ bool SwCTBWrapper::Read( SvStream& rS )
     std::vector< sal_Int16 >::iterator it_end = dropDownMenuIndices.end();
     for ( std::vector< sal_Int16 >::iterator it = dropDownMenuIndices.begin(); it != it_end; ++it )
     {
-        rCustomizations[ *it ].bIsDroppedMenuTB = true;
+        if (*it < 0 || static_cast<size_t>(*it) >= rCustomizations.size())
+            continue;
+        rCustomizations[*it].bIsDroppedMenuTB = true;
     }
     return rS.good();
 }