clean up places accessing the NULL at the of an OUString

There were only a couple of real bugs fixed, but we're a little
bit safer now.
This also fixes the assert and the comment in OUString::operator[]
about this.

Change-Id: Ibe16b5794e0ba7ecd345fa0801586d25b015974c

6 files changed, 7 insertions, 7 deletions

diff --git a/sw/source/core/crsr/bookmrk.cxx b/sw/source/core/crsr/bookmrk.cxx
index 3a4ba43c6de4..962f5268aa44 100644
--- a/sw/source/core/crsr/bookmrk.cxx
+++ b/sw/source/core/crsr/bookmrk.cxx
@@ -70,11 +70,11 @@ namespace
         SwTxtNode const*const pStartTxtNode =
             rStart.nNode.GetNode().GetTxtNode();
         SwTxtNode const*const pEndTxtNode = rEnd.nNode.GetNode().GetTxtNode();
-        const sal_Unicode ch_start =
+        const sal_Unicode ch_start = ( rStart.nContent.GetIndex() >= pStartTxtNode->GetTxt().getLength() ) ? 0 :
             pStartTxtNode->GetTxt()[rStart.nContent.GetIndex()];
         xub_StrLen nEndPos = ( rEnd == rStart ||  rEnd.nContent.GetIndex() == 0 ) ?
             rEnd.nContent.GetIndex() : rEnd.nContent.GetIndex() - 1;
-        const sal_Unicode ch_end = pEndTxtNode->GetTxt()[nEndPos];
+        const sal_Unicode ch_end = nEndPos >= pEndTxtNode->GetTxt().getLength() ? 0 : pEndTxtNode->GetTxt()[nEndPos];
         SwPaM aStartPaM(rStart);
         SwPaM aEndPaM(rEnd);
 
diff --git a/sw/source/core/edit/edattr.cxx b/sw/source/core/edit/edattr.cxx
index d9cfcadcf0e5..8e01455bd693 100644
--- a/sw/source/core/edit/edattr.cxx
+++ b/sw/source/core/edit/edattr.cxx
@@ -493,7 +493,7 @@ static bool lcl_IsNoEndTxtAttrAtPos( const SwTxtNode& rTNd, xub_StrLen nPos,
     }
 
     // and fields
-    if (CH_TXTATR_BREAKWORD == rTNd.GetTxt()[nPos])
+    if (nPos < rTNd.GetTxt().getLength() && CH_TXTATR_BREAKWORD == rTNd.GetTxt()[nPos])
     {
         const SwTxtAttr* const pAttr = rTNd.GetTxtAttrForCharAt( nPos );
         if (pAttr)
diff --git a/sw/source/core/text/itrform2.cxx b/sw/source/core/text/itrform2.cxx
index 180b240f64a7..5c284615b92c 100644
--- a/sw/source/core/text/itrform2.cxx
+++ b/sw/source/core/text/itrform2.cxx
@@ -2027,7 +2027,7 @@ sal_Bool SwTxtFormatter::AllowRepaintOpt() const
     const xub_StrLen nReformat = GetInfo().GetReformatStart();
     if( bOptimizeRepaint && STRING_LEN != nReformat )
     {
-        const sal_Unicode cCh = GetInfo().GetTxt()[ nReformat ];
+        const sal_Unicode cCh = nReformat >= GetInfo().GetTxt().getLength() ? 0 : GetInfo().GetTxt()[ nReformat ];
         bOptimizeRepaint = ( CH_TXTATR_BREAKWORD != cCh && CH_TXTATR_INWORD != cCh )
                             || ! GetInfo().HasHint( nReformat );
     }
diff --git a/sw/source/core/text/pormulti.cxx b/sw/source/core/text/pormulti.cxx
index ab18a829ad7e..9c1c05731ea1 100644
--- a/sw/source/core/text/pormulti.cxx
+++ b/sw/source/core/text/pormulti.cxx
@@ -885,7 +885,7 @@ SwMultiCreator* SwTxtSizeInfo::GetMultiCreator( xub_StrLen &rPos,
     sal_uInt8 nNextLevel = nCurrLevel;
     bool bFldBidi = false;
 
-    if ( CH_TXTATR_BREAKWORD == GetChar( rPos ) )
+    if ( rPos < GetTxt().getLength() && CH_TXTATR_BREAKWORD == GetChar( rPos ) )
     {
         bFldBidi = true;
     }
diff --git a/sw/source/core/text/txtfrm.cxx b/sw/source/core/text/txtfrm.cxx
index 03dbba33344a..acb60ef8dc07 100644
--- a/sw/source/core/text/txtfrm.cxx
+++ b/sw/source/core/text/txtfrm.cxx
@@ -648,7 +648,7 @@ xub_StrLen SwTxtFrm::FindBrk( const OUString &rTxt,
                               const sal_Int32 nEnd ) const
 {
     sal_Int32 nFound = nStart;
-    const sal_Int32 nEndLine = std::min( nEnd, rTxt.getLength() );
+    const sal_Int32 nEndLine = std::min( nEnd, rTxt.getLength() - 1 );
 
     // Wir ueberlesen erst alle Blanks am Anfang der Zeile (vgl. Bug 2235).
     while( nFound <= nEndLine && ' ' == rTxt[nFound] )
diff --git a/sw/source/filter/ww8/writerwordglue.cxx b/sw/source/filter/ww8/writerwordglue.cxx
index 35be5fa6acfc..af8c32ea7d37 100644
--- a/sw/source/filter/ww8/writerwordglue.cxx
+++ b/sw/source/filter/ww8/writerwordglue.cxx
@@ -827,9 +827,9 @@ namespace sw
                         if (!(IsPreviousAM(rParams, nI) && IsNextPM(rParams, nI)))
                         {
                             rParams = rParams.replaceAt(nI, 1, "\\/");
+                            nLen++;
                         }
                         nI++;
-                        nLen++;
                     }
 
                     // Deal with language differences in date format expression.