From 839cc63e7d1b78c56e04bafb46037e898ce2c455 Mon Sep 17 00:00:00 2001
From: Eike Rathke <erack@redhat.com>
Date: Mon, 18 Aug 2014 14:09:20 +0200
Subject: prevent out-of-bounds string access

... while entering a   *   star symbol format code and there's no fill
character following the * yet.

Change-Id: I006f125ceefccba6a95ea033fd434d98e5d4f1c2
---
 svl/source/numbers/zformat.cxx | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'svl')

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 5815cac9147d..69e0059b7c19 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -2590,8 +2590,18 @@ bool SvNumberformat::GetOutputString(double fNumber,
                     if( bStarFlag )
                     {
                         sBuff.append((sal_Unicode) 0x1B);
-                        sBuff.append(rInfo.sStrArray[i][1]);
-                        bRes = true;
+                        const OUString& rStr =rInfo.sStrArray[i];
+                        // Right during user input the star symbol is the very
+                        // last character before the user enters another one.
+                        if (rStr.getLength() > 1)
+                        {
+                            sBuff.append(rStr[1]);
+                            bRes = true;
+                        }
+                        else
+                        {
+                            bRes = false;
+                        }
                     }
                     break;
                 case NF_SYMBOLTYPE_BLANK:
-- 
cgit