From d4938dfcaf4f5fbcb5a576fe9425b6d62584122f Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 10 Oct 2018 09:42:36 +0100 Subject: ofz#10879 stay inside sSecStr bounds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I0ca70cdb9b80305c5339668d65d2c4c9977e7160 Reviewed-on: https://gerrit.libreoffice.org/61604 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- svl/source/numbers/zformat.cxx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx index aef0c17b1691..077baa7ab2e5 100644 --- a/svl/source/numbers/zformat.cxx +++ b/svl/source/numbers/zformat.cxx @@ -3133,7 +3133,7 @@ bool SvNumberformat::ImpGetTimeOutput(double fNumber, (rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING || rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ? nCntPost : rInfo.sStrArray[i].getLength() ); - for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++) + for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < sSecStr.getLength(); ++j) { sBuff.append(sSecStr[nSecPos]); nSecPos++; @@ -4010,7 +4010,7 @@ bool SvNumberformat::ImpGetDateTimeOutput(double fNumber, (rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING || rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ? nCntPost : rInfo.sStrArray[i].getLength() ); - for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++) + for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < sSecStr.getLength(); ++j) { sBuff.append(sSecStr[ nSecPos ]); nSecPos++; -- cgit