diff options
| author | PriyankaGaikwad <priyanka.gaikwad@synerzip.com> | 2014-06-20 18:53:29 +0530 |
|---|---|---|
| committer | Muthu Subramanian K <muthusuba@gmail.com> | 2014-06-20 14:38:14 +0000 |
| commit | 077121eb0debc1c78cf46038e2b90a0c2f381c44 (patch) | |
| tree | 4886ee26e7d5e27fe578379f586f219249704ee0 /starmath | |
| parent | 6e714e618353b9eccf04efc15a5987ee10793309 (diff) | |
fdo#79973 : LO crashes while opening the document.
Description:
- If the equation ends with two dots(.) then file get crash.
- In SmParser::NextToken()
the file get crash because string index is out of bound.
Change-Id: I5f25814220d556d53c10d4ca33a38b4d0d451438
Reviewed-on: https://gerrit.libreoffice.org/9840
Reviewed-by: Muthu Subramanian K <muthusuba@gmail.com>
Tested-by: Muthu Subramanian K <muthusuba@gmail.com>
Diffstat (limited to 'starmath')
| -rw-r--r-- | starmath/source/parse.cxx | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/starmath/source/parse.cxx b/starmath/source/parse.cxx index c78a0400a385..b7373f122434 100644 --- a/starmath/source/parse.cxx +++ b/starmath/source/parse.cxx @@ -884,11 +884,13 @@ void SmParser::NextToken() sal_Int32 nTxtStart = m_nBufferIndex; sal_Unicode cChar; + // if the equation ends with dot(.) then increment m_nBufferIndex till end of string only do { cChar = m_aBufferString[ ++m_nBufferIndex ]; } - while ( cChar == '.' || rtl::isAsciiDigit( cChar ) ); + while ( (cChar == '.' || rtl::isAsciiDigit( cChar )) && + ( m_nBufferIndex < m_aBufferString.getLength() - 1 ) ); m_aCurToken.aText = m_aBufferString.copy( nTxtStart, m_nBufferIndex - nTxtStart ); aRes.EndPos = m_nBufferIndex; |