diff options
| author | Eike Rathke <erack@redhat.com> | 2014-08-22 00:11:18 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2014-08-22 00:16:15 +0200 |
| commit | 07b18860ae03ecb66b5605201f34c2aef3a55ad6 (patch) | |
| tree | e7c1f3380a30efa3763515c3d4aa6f2d389423ca | |
| parent | 9df3a83c304f3dd0e0233d234dc6036ab5eefb77 (diff) | |
out-of-bounds string access
... when parsing ='foo'# with no character following.
Change-Id: Id65fce721cb47a4d3c947c677323bdcaa2ce957f
| -rw-r--r-- | sc/source/core/tool/compiler.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx index 93d8f1925709..8c3e485991de 100644 --- a/sc/source/core/tool/compiler.cxx +++ b/sc/source/core/tool/compiler.cxx @@ -426,7 +426,7 @@ static bool lcl_isValidQuotedText( const OUString& rFormula, sal_Int32 nSrcPos, // but '' marks an escaped ' // We've earlier guaranteed that a string containing '' will be // surrounded by ' - if (rFormula[nSrcPos] == '\'') + if (nSrcPos < rFormula.getLength() && rFormula[nSrcPos] == '\'') { sal_Int32 nPos = nSrcPos+1; while (nPos < rFormula.getLength()) |