From c407fff205a270e02fe07885805b7250e71c28f8 Mon Sep 17 00:00:00 2001
From: Eike Rathke <erack@redhat.com>
Date: Fri, 10 Mar 2017 13:48:24 +0100
Subject: prevent string access out of bounds

Though only the closing 0-character and the following check excludes that,
dbgutil asserts.

Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7
---
 svl/source/numbers/zforscan.cxx | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

(limited to 'svl')

diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 7dbbb99a43da..5644c2b0e911 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -814,18 +814,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr,
                 switch (cToken)
                 {
                 case '/': // AM/PM, A/P
-                    cNext = rStr[nPos];
-                    if ( cNext == 'P' || cNext == 'p' )
+                    if (nPos < rStr.getLength())
                     {
-                        sal_Int32 nLen = sSymbol.getLength();
-                        if ( 1 <= nLen &&
-                             (sSymbol[0] == 'A' || sSymbol[0] == 'a') &&
-                             (nLen == 1 ||
-                              (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm')
-                               && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm'))))
+                        cNext = rStr[nPos];
+                        if ( cNext == 'P' || cNext == 'p' )
                         {
-                            sSymbol += OUStringLiteral1(cToken);
-                            bDontStop = true;
+                            sal_Int32 nLen = sSymbol.getLength();
+                            if ( 1 <= nLen &&
+                                    (sSymbol[0] == 'A' || sSymbol[0] == 'a') &&
+                                    (nLen == 1 ||
+                                     (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm')
+                                      && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm'))))
+                            {
+                                sSymbol += OUStringLiteral1(cToken);
+                                bDontStop = true;
+                            }
                         }
                     }
                     break;
-- 
cgit