From d8c1365f0391cc9f21690b711badc5a0203d1499 Mon Sep 17 00:00:00 2001 From: Eike Rathke Date: Fri, 10 Mar 2017 13:48:24 +0100 Subject: prevent string access out of bounds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Though only the closing 0-character and the following check excludes that, dbgutil asserts. (cherry picked from commit c407fff205a270e02fe07885805b7250e71c28f8) Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7 Reviewed-on: https://gerrit.libreoffice.org/35044 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara (cherry picked from commit 73d241d9b876bf464176878d76ae6f6497341a13) --- svl/source/numbers/zforscan.cxx | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) (limited to 'svl/source') diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx index 807fb6316dd9..f67e7f0be502 100644 --- a/svl/source/numbers/zforscan.cxx +++ b/svl/source/numbers/zforscan.cxx @@ -832,18 +832,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr, switch (cToken) { case '/': // AM/PM, A/P - cNext = rStr[nPos]; - if ( cNext == 'P' || cNext == 'p' ) + if (nPos < rStr.getLength()) { - sal_Int32 nLen = sSymbol.getLength(); - if ( 1 <= nLen && - (sSymbol[0] == 'A' || sSymbol[0] == 'a') && - (nLen == 1 || - (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') - && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + cNext = rStr[nPos]; + if ( cNext == 'P' || cNext == 'p' ) { - sSymbol += OUString(cToken); - bDontStop = true; + sal_Int32 nLen = sSymbol.getLength(); + if ( 1 <= nLen && + (sSymbol[0] == 'A' || sSymbol[0] == 'a') && + (nLen == 1 || + (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') + && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + { + sSymbol += OUString(cToken); + bDontStop = true; + } } } break; -- cgit