diff options
| author | Eike Rathke <erack@redhat.com> | 2017-03-10 13:48:24 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2017-04-23 13:13:46 +0200 |
| commit | d8c1365f0391cc9f21690b711badc5a0203d1499 (patch) | |
| tree | ca5b733badb34a96a34c649852d07591a1654d73 /svl/source | |
| parent | f3aaa6229c6feaf132e8f8e031d67d6776564a97 (diff) | |
prevent string access out of bounds
Though only the closing 0-character and the following check excludes that,
dbgutil asserts.
(cherry picked from commit c407fff205a270e02fe07885805b7250e71c28f8)
Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7
Reviewed-on: https://gerrit.libreoffice.org/35044
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 73d241d9b876bf464176878d76ae6f6497341a13)
Diffstat (limited to 'svl/source')
| -rw-r--r-- | svl/source/numbers/zforscan.cxx | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx index 807fb6316dd9..f67e7f0be502 100644 --- a/svl/source/numbers/zforscan.cxx +++ b/svl/source/numbers/zforscan.cxx @@ -832,18 +832,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr, switch (cToken) { case '/': // AM/PM, A/P - cNext = rStr[nPos]; - if ( cNext == 'P' || cNext == 'p' ) + if (nPos < rStr.getLength()) { - sal_Int32 nLen = sSymbol.getLength(); - if ( 1 <= nLen && - (sSymbol[0] == 'A' || sSymbol[0] == 'a') && - (nLen == 1 || - (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') - && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + cNext = rStr[nPos]; + if ( cNext == 'P' || cNext == 'p' ) { - sSymbol += OUString(cToken); - bDontStop = true; + sal_Int32 nLen = sSymbol.getLength(); + if ( 1 <= nLen && + (sSymbol[0] == 'A' || sSymbol[0] == 'a') && + (nLen == 1 || + (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') + && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + { + sSymbol += OUString(cToken); + bDontStop = true; + } } } break; |