From d63406ec35ce3d22b8f3e78b46c46dd71b6b91e4 Mon Sep 17 00:00:00 2001
From: Eike Rathke <erack@redhat.com>
Date: Mon, 30 Mar 2015 21:29:46 +0200
Subject: Resolves: tdf#90301 string access out of bounds

Apparently yet another leftover of UniString to OUString conversion
where with UniString out-of-bounds accesses didn't harm and returned
NIL.

(cherry picked from commit eed393039a9067f7a1a318934ff1c5ff90bfe443)

Include <algorithm> for std::min()

(cherry picked from commit 3394ac816a573030feda145dbdabd2a1eabd78c4)

13ed47d23ed4b94501d9445555d99ce08af94698

Change-Id: Id88456a52df3fc8cdaf90d9d509e327b96269808
Reviewed-on: https://gerrit.libreoffice.org/15074
Tested-by: David Tardon <dtardon@redhat.com>
Reviewed-by: David Tardon <dtardon@redhat.com>
---
 formula/source/ui/dlg/FormulaHelper.cxx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/formula/source/ui/dlg/FormulaHelper.cxx b/formula/source/ui/dlg/FormulaHelper.cxx
index 6c999bdea0bb..9d9bda1e4fc6 100644
--- a/formula/source/ui/dlg/FormulaHelper.cxx
+++ b/formula/source/ui/dlg/FormulaHelper.cxx
@@ -17,6 +17,8 @@
  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  */
 
+#include <algorithm>
+
 #include "formula/formulahelper.hxx"
 #include <unotools/charclass.hxx>
 #include <unotools/syslocale.hxx>
@@ -201,7 +203,7 @@ sal_Int32 FormulaHelper::GetFunctionStart( const OUString&   rFormula,
         return nStart;
 
     sal_Int32  nFStart = FUNC_NOTFOUND;
-    sal_Int32  nParPos = nStart;
+    sal_Int32  nParPos = bBack ? ::std::min( nStart, nStrLen - 1) : nStart;
 
     bool bRepeat, bFound;
     do
-- 
cgit