avoid out of bounds string access

as demonstrated by ooo109591-1.doc

Change-Id: I91b4940828038561885e8d3a109c40a668aeb15b

1 files changed, 5 insertions, 1 deletions

diff --git a/sw/source/core/text/itrform2.cxx b/sw/source/core/text/itrform2.cxx
index 5fa402976f77..c0588496d303 100644
--- a/sw/source/core/text/itrform2.cxx
+++ b/sw/source/core/text/itrform2.cxx
@@ -467,7 +467,11 @@ void SwTxtFormatter::BuildPortions( SwTxtFormatInfo &rInf )
                 }
             }
             else
-                bAllowBehind = rCC.isLetterNumeric( rInf.GetTxt(), rInf.GetIdx() );
+            {
+                const OUString& rTxt = rInf.GetTxt();
+                sal_Int32 nIdx = rInf.GetIdx();
+                bAllowBehind = nIdx < rTxt.getLength() ? rCC.isLetterNumeric(rTxt, nIdx) : false;
+            }
 
             const SwLinePortion* pLast = rInf.GetLast();
             if ( bAllowBehind && pLast )