diff options
| author | Eike Rathke <erack@redhat.com> | 2017-03-10 13:48:24 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2017-03-10 13:58:17 +0100 |
| commit | c407fff205a270e02fe07885805b7250e71c28f8 (patch) | |
| tree | ddff9292ec1c8cf0f9e775e28230271a0cd33c82 /svl | |
| parent | 77a8cf7eaf638276030d1c5be8705f5603f071a9 (diff) | |
prevent string access out of bounds
Though only the closing 0-character and the following check excludes that,
dbgutil asserts.
Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7
Diffstat (limited to 'svl')
| -rw-r--r-- | svl/source/numbers/zforscan.cxx | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx index 7dbbb99a43da..5644c2b0e911 100644 --- a/svl/source/numbers/zforscan.cxx +++ b/svl/source/numbers/zforscan.cxx @@ -814,18 +814,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr, switch (cToken) { case '/': // AM/PM, A/P - cNext = rStr[nPos]; - if ( cNext == 'P' || cNext == 'p' ) + if (nPos < rStr.getLength()) { - sal_Int32 nLen = sSymbol.getLength(); - if ( 1 <= nLen && - (sSymbol[0] == 'A' || sSymbol[0] == 'a') && - (nLen == 1 || - (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') - && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + cNext = rStr[nPos]; + if ( cNext == 'P' || cNext == 'p' ) { - sSymbol += OUStringLiteral1(cToken); - bDontStop = true; + sal_Int32 nLen = sSymbol.getLength(); + if ( 1 <= nLen && + (sSymbol[0] == 'A' || sSymbol[0] == 'a') && + (nLen == 1 || + (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') + && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + { + sSymbol += OUStringLiteral1(cToken); + bDontStop = true; + } } } break; |