From 77a8cf7eaf638276030d1c5be8705f5603f071a9 Mon Sep 17 00:00:00 2001
From: Eike Rathke <erack@redhat.com>
Date: Fri, 10 Mar 2017 13:38:28 +0100
Subject: string access out of bounds

Change-Id: I4f6e6e8e77cdabe593bca5719b6ef38aeecc5da7
---
 svl/source/numbers/zformat.cxx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 1de8ffcdc8df..91c36d43b25f 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -2838,9 +2838,13 @@ bool SvNumberformat::ImpGetFractionOutput(double fNumber,
     bRes |= ImpNumberFill(sDiv, fNumber, k, j, nIx, NF_SYMBOLTYPE_FRAC);
     if ( !bHideFraction &&  sDenominatorFormat.getLength() > 0 )
     {
+        sal_Int32 nDenominatorLen = sDenominatorFormat.getLength();
         while ( sDiv[0] == ' ' ) // left align denominator
         {
-            sDiv.insert( sDenominatorFormat.getLength(), " " );
+            if (sDiv.getLength() <= nDenominatorLen)
+                sDiv.append(" ");
+            else
+                sDiv.insert( nDenominatorLen, " " );
             sDiv.remove( 0, 1 );
         }
     }
-- 
cgit