From 5effaa90f38d55f035d381ad8982d2ed6b9d46de Mon Sep 17 00:00:00 2001
From: Michael Stahl <mstahl@redhat.com>
Date: Wed, 6 Nov 2013 20:53:13 +0100
Subject: idl: fix out of bounds string accesses

Change-Id: Id0d07ff9bcd4858cb74458eaf13fb9386387f455
---
 idl/inc/lex.hxx             | 4 +++-
 idl/source/cmptools/lex.cxx | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

(limited to 'idl')

diff --git a/idl/inc/lex.hxx b/idl/inc/lex.hxx
index 238f5b904d20..2f816358bca8 100644
--- a/idl/inc/lex.hxx
+++ b/idl/inc/lex.hxx
@@ -140,7 +140,9 @@ class SvTokenStream
     int             GetNextChar();
     int             GetFastNextChar()
                     {
-                        return aBufStr[nBufPos++];
+                        return (nBufPos < aBufStr.getLength())
+                            ? aBufStr[nBufPos++]
+                            : '\0';
                     }
 
     void            FillTokenList();
diff --git a/idl/source/cmptools/lex.cxx b/idl/source/cmptools/lex.cxx
index d6644b8e1297..3e131ee7bf43 100644
--- a/idl/source/cmptools/lex.cxx
+++ b/idl/source/cmptools/lex.cxx
@@ -151,9 +151,9 @@ void SvTokenStream::FillTokenList()
 int SvTokenStream::GetNextChar()
 {
     int nChar;
-    if( aBufStr.getLength() < nBufPos )
+    while (aBufStr.getLength() <= nBufPos)
     {
-        if( rInStream.ReadLine( aBufStr ) )
+        if (rInStream.ReadLine(aBufStr))
         {
             nLine++;
             nColumn = 0;
-- 
cgit