From e7c6ebf38fe5e27c598dff970851d2e9fef6adc5 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 6 Nov 2013 15:24:55 +0000
Subject: check string bounds

as demonstrated by fdo54887-1.ods

Change-Id: I2d5568126c58c831446b4c4b050ffed193f7921d
---
 svl/source/numbers/zforscan.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'svl')

diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 1fb4d657cad4..fe0bc311d251 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -762,7 +762,7 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr,
                             eType = nTmpType;
                             sal_Int32 nLen = sKeyword[eType].getLength();
                             sSymbol = rStr.copy( nPos-1, nLen );
-                            if ( eType == NF_KEY_E || IsAmbiguousE( eType ) )
+                            if ((eType == NF_KEY_E || IsAmbiguousE(eType)) && nPos < rStr.getLength())
                             {
                                 sal_Unicode cNext = rStr[nPos];
                                 switch ( cNext )
-- 
cgit