diff options
| author | David Tardon <dtardon@redhat.com> | 2011-05-14 13:59:11 +0200 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2011-05-16 17:35:02 +0200 |
| commit | 0c8fd6cd283f803d450c417ff4f94616549de552 (patch) | |
| tree | f3fb0188c370c37398f743a73bc4bec87abadd3a | |
| parent | be2ec9d36b8d34e69d228199ba05c7a01483da33 (diff) | |
avoid possible array overrun
| -rw-r--r-- | svl/source/numbers/zforscan.cxx | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx index 7610092480..02910f8953 100644 --- a/svl/source/numbers/zforscan.cxx +++ b/svl/source/numbers/zforscan.cxx @@ -1400,11 +1400,12 @@ bool ImpSvNumberformatScan::InsertSymbol( sal_uInt16 & nPos, svt::NfSymbolType e { if (nAnzStrings >= NF_MAX_FORMAT_SYMBOLS || nPos > nAnzStrings) return false; - ++nAnzResStrings; if (nPos > 0 && nTypeArray[nPos-1] == NF_SYMBOLTYPE_EMPTY) --nPos; // reuse position else { + if (nAnzStrings + 1 >= NF_MAX_FORMAT_SYMBOLS) + return false; ++nAnzStrings; for (size_t i = nAnzStrings; i > nPos; --i) { @@ -1412,6 +1413,7 @@ bool ImpSvNumberformatScan::InsertSymbol( sal_uInt16 & nPos, svt::NfSymbolType e sStrArray[i] = sStrArray[i-1]; } } + ++nAnzResStrings; nTypeArray[nPos] = static_cast<short>(eType); sStrArray[nPos] = rStr; return true; |