diff options
| author | Eike Rathke <erack@redhat.com> | 2014-08-18 14:09:20 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2014-08-18 14:50:16 +0200 |
| commit | 839cc63e7d1b78c56e04bafb46037e898ce2c455 (patch) | |
| tree | 1454db2a1dc9ed938f1aa86a395cedc322bb41f6 /svl | |
| parent | d4cf8c2518c77631f91db8564bf3a506f0ab8e70 (diff) | |
prevent out-of-bounds string access
... while entering a * star symbol format code and there's no fill
character following the * yet.
Change-Id: I006f125ceefccba6a95ea033fd434d98e5d4f1c2
Diffstat (limited to 'svl')
| -rw-r--r-- | svl/source/numbers/zformat.cxx | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx index 5815cac9147d..69e0059b7c19 100644 --- a/svl/source/numbers/zformat.cxx +++ b/svl/source/numbers/zformat.cxx @@ -2590,8 +2590,18 @@ bool SvNumberformat::GetOutputString(double fNumber, if( bStarFlag ) { sBuff.append((sal_Unicode) 0x1B); - sBuff.append(rInfo.sStrArray[i][1]); - bRes = true; + const OUString& rStr =rInfo.sStrArray[i]; + // Right during user input the star symbol is the very + // last character before the user enters another one. + if (rStr.getLength() > 1) + { + sBuff.append(rStr[1]); + bRes = true; + } + else + { + bRes = false; + } } break; case NF_SYMBOLTYPE_BLANK: |