prevent out-of-bounds string access

... while entering a   *   star symbol format code and there's no fill
character following the * yet, for example  "xxx"*

(cherry picked from commit 839cc63e7d1b78c56e04bafb46037e898ce2c455)

more out-of-bounds string accesses

(cherry picked from commit 349c93e0f5c9f231b2ff6854fcb795ca5881ca2d)

Change-Id: I006f125ceefccba6a95ea033fd434d98e5d4f1c2
Reviewed-on: https://gerrit.libreoffice.org/10994
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>

1 files changed, 15 insertions, 3 deletions

diff --git a/cui/source/tabpages/numfmt.cxx b/cui/source/tabpages/numfmt.cxx
index 52d23567c2b7..d4af55c7883e 100644
--- a/cui/source/tabpages/numfmt.cxx
+++ b/cui/source/tabpages/numfmt.cxx
@@ -112,9 +112,21 @@ void SvxNumberPreview::NotifyChange( const OUString& rPrevStr,
     mnPos = aPrevStr.indexOf( 0x1B );
     if ( mnPos != -1 )
     {
-        mnChar = aPrevStr[ mnPos + 1 ];
-        // delete placeholder and char to repeat
-        aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" );
+        // Right during user input the star symbol is the very
+        // last character before the user enters another one.
+        if (mnPos < aPrevStr.getLength() - 1)
+        {
+            mnChar = aPrevStr[ mnPos + 1 ];
+            // delete placeholder and char to repeat
+            aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" );
+        }
+        else
+        {
+            // delete placeholder
+            aPrevStr = aPrevStr.replaceAt( mnPos, 1, "" );
+            // do not attempt to draw a 0 fill character
+            mnPos = -1;
+        }
     }
     svtools::ColorConfig aColorConfig;
     Color aWindowTextColor( aColorConfig.GetColorValue( svtools::FONTCOLOR ).nColor );