diff options
| author | David Tardon <dtardon@redhat.com> | 2011-05-14 13:59:11 +0200 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2011-05-16 17:35:02 +0200 |
| commit | bc64f511968eb0266cb56b0bc9bb5a0d6831189f (patch) | |
| tree | 57656f2e41fd1f02ede51740260cb4b59e67c781 /svl/source/numbers/zforscan.cxx | |
| parent | ccf2c83ab786f87d549a7d2af6c48077977469f9 (diff) | |
avoid possible array overrun
Diffstat (limited to 'svl/source/numbers/zforscan.cxx')
| -rw-r--r-- | svl/source/numbers/zforscan.cxx | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx index b7077b00e134..ab77de17c56c 100644 --- a/svl/source/numbers/zforscan.cxx +++ b/svl/source/numbers/zforscan.cxx @@ -1400,11 +1400,12 @@ bool ImpSvNumberformatScan::InsertSymbol( sal_uInt16 & nPos, svt::NfSymbolType e { if (nAnzStrings >= NF_MAX_FORMAT_SYMBOLS || nPos > nAnzStrings) return false; - ++nAnzResStrings; if (nPos > 0 && nTypeArray[nPos-1] == NF_SYMBOLTYPE_EMPTY) --nPos; // reuse position else { + if (nAnzStrings + 1 >= NF_MAX_FORMAT_SYMBOLS) + return false; ++nAnzStrings; for (size_t i = nAnzStrings; i > nPos; --i) { @@ -1412,6 +1413,7 @@ bool ImpSvNumberformatScan::InsertSymbol( sal_uInt16 & nPos, svt::NfSymbolType e sStrArray[i] = sStrArray[i-1]; } } + ++nAnzResStrings; nTypeArray[nPos] = static_cast<short>(eType); sStrArray[nPos] = rStr; return true; |