From 9ff0df208be033eef449b7bb35d5dc4d4b335231 Mon Sep 17 00:00:00 2001
From: Noel Grandin <noel.grandin@collabora.co.uk>
Date: Thu, 26 Feb 2026 10:57:42 +0200
Subject: [PATCH] fix pointer arithmetic in SvMemoryStream::PutData

after
  commit fa002b6244207ff2bb92f7e714d56c4e2b103064
  Author: Noel Grandin <noelgrandin@gmail.com>
  Date:   Sat Feb 21 21:00:32 2026 +0200
  fix asan heap-use-after-free

Change-Id: I2ed04d2957089f2e6968ac63b14639e27709295c
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/200400
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
Tested-by: Noel Grandin <noel.grandin@collabora.co.uk>
---
 tools/source/stream/stream.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/source/stream/stream.cxx b/tools/source/stream/stream.cxx
index 77d06abfe0fd..01c33a3ab534 100644
--- a/tools/source/stream/stream.cxx
+++ b/tools/source/stream/stream.cxx
@@ -1646,7 +1646,7 @@ std::size_t SvMemoryStream::PutData( const void* pData, std::size_t nCount )
         }
         else
         {
-            const bool bSourceDataIsInsideBuffer = pData >= pBuf && pData <= (pBuf + nSize);
+            const bool bSourceDataIsInsideBuffer = pData >= pBuf && pData < (pBuf + nSize);
             std::ptrdiff_t const offset = bSourceDataIsInsideBuffer ? static_cast<const char*>(pData) - reinterpret_cast<const char*>(pBuf) : 0;
             tools::Long nNewResize;
             if( nSize && nSize > nResize )