| author | Miklos Vajna <vmiklos@suse.cz> | 2012-07-27 15:26:12 (GMT) |
|---|---|---|
| committer | Miklos Vajna <vmiklos@suse.cz> | 2012-07-27 15:28:09 (GMT) |
| commit | 55d72ab8ec4e4445e62f8224b5f54e97c464c4a5 (patch) (side-by-side diff) | |
| tree | fec6dc8d79b1160199c034fbb2bbde22930411d1 | |
| parent | 2d422d868a717adf735ef45a6bf5e4af0efb1a0c (diff) | |
| download | core-55d72ab8ec4e4445e62f8224b5f54e97c464c4a5.zip core-55d72ab8ec4e4445e62f8224b5f54e97c464c4a5.tar.gz | |
RTFDocumentImpl::text: don't try to read beyond the end of string
Change-Id: If8dc4686f28870f1ce6b22458e29d3a9043f9783
| -rw-r--r-- | writerfilter/source/rtftok/rtfdocumentimpl.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx index 6729b88..b63bc3c 100644 --- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx +++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx @@ -984,7 +984,7 @@ void RTFDocumentImpl::text(OUString& rString) m_aStates.top().aDestinationText.append(rString); break; case DESTINATION_EQINSTRUCTION: - if ( rString.copy(0, 2) == "do" && rString.copy(2).toInt32() > 0 ) + if ( rString.getLength() > 3 && rString.copy(0, 2) == "do" && rString.copy(2).toInt32() > 0 ) dispatchFlag(RTF_SUB); break; default: bRet = false; break; |