From d1cdf9a24de0d87f22e283f5cb2ed93ff6e83ee6 Mon Sep 17 00:00:00 2001
From: Stephan Bergmann <sbergman@redhat.com>
Date: Tue, 31 May 2022 20:35:26 +0200
Subject: [PATCH] Also assert that nNodeType is non-negative

...given that nNodeType aka AnimationNode::mnNodeType is later used as an index
into the AnimationNode::mpTypes array

Change-Id: Ic208fbdfaa8dcca44ff2a99cf3b169904b14a4bf
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/135203
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
---
 animations/source/animcore/animcore.cxx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/animations/source/animcore/animcore.cxx b/animations/source/animcore/animcore.cxx
index c02ba3ca2878..737da604a594 100644
--- a/animations/source/animcore/animcore.cxx
+++ b/animations/source/animcore/animcore.cxx
@@ -55,6 +55,7 @@
 
 #include <cppuhelper/implbase.hxx>
 
+#include <o3tl/safeint.hxx>
 #include <osl/mutex.hxx>
 #include <sal/log.hxx>
 #include <array>
@@ -446,7 +447,7 @@ AnimationNode::AnimationNode( sal_Int16 nNodeType )
     mnIterateType( css::presentation::ShapeAnimationSubType::AS_WHOLE ),
     mfIterateInterval(0.0)
 {
-    assert(nNodeType < int(mpTypes.size()));
+    assert(nNodeType >= 0 && o3tl::make_unsigned(nNodeType) < mpTypes.size());
 }
 
 AnimationNode::AnimationNode( const AnimationNode& rNode )