diff options
| author | Eike Rathke <erack@redhat.com> | 2013-10-16 21:52:18 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2013-10-16 21:59:18 +0200 |
| commit | f46cb0c45a3e00057c1bcf73ac850ef44d470b9d (patch) | |
| tree | 53faad60cef97455b9730ec88d28c71da1c9ab52 /sc/source/ui/app | |
| parent | 31d3ab5ea19268cb51a5efdd6ac0065dfce25f28 (diff) | |
fixed out-of-bounds OUString access
Change-Id: I971c339f2cb4cddcf4fbb447eb79282d34979220
Diffstat (limited to 'sc/source/ui/app')
| -rw-r--r-- | sc/source/ui/app/inputhdl.cxx | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sc/source/ui/app/inputhdl.cxx b/sc/source/ui/app/inputhdl.cxx index 72bfec865a47..c35d3d6059b0 100644 --- a/sc/source/ui/app/inputhdl.cxx +++ b/sc/source/ui/app/inputhdl.cxx @@ -956,7 +956,8 @@ void ScInputHandler::ShowTipCursor() { sal_uInt16 nPosition = 0; OUString aText = pEngine->GetWord( 0, aSel.nEndPos-1 ); - if( aText[ aSel.nEndPos-1 ] == '=' ) + /* XXX: dubious, what is this condition supposed to exactly match? */ + if (aSel.nEndPos <= aText.getLength() && aText[ aSel.nEndPos-1 ] == '=') { break; } |