diff options
| author | Eike Rathke <erack@redhat.com> | 2014-08-27 00:30:01 +0200 |
|---|---|---|
| committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2014-08-27 01:10:48 -0500 |
| commit | 5c1b508b172f0047d86e1acde92239ebf3438251 (patch) | |
| tree | 1077b3ede62f0043dbe3a1a55b077ab98f5e311d | |
| parent | ff518ba8a6d2ed88c7992ead856d7f7987a04919 (diff) | |
out-of-bounds string access, this comparison never matched
aName == aLinkTabName.copy(nIndex, nLinkTabNameLength)
is not a replacement for
String(aName).Equals(String(aLinkTabName), nIndex, nLinkTabNameLength)
instead use
aName.match( aLinkTabName, nIndex)
because here nLinkTabNameLength actually is aLinkTabName.getLength()
Change-Id: I884f56541f819db5672e9d096a26a3673e82d83b
(cherry picked from commit aebcabd54cc5587f3856c48db0a4c4fc0f3f8ce8)
Reviewed-on: https://gerrit.libreoffice.org/11133
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
| -rw-r--r-- | sc/source/ui/docshell/docsh.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx index 7ed1836346d0..79a499bd4982 100644 --- a/sc/source/ui/docshell/docsh.cxx +++ b/sc/source/ui/docshell/docsh.cxx @@ -320,7 +320,7 @@ void ScDocShell::AfterXMLLoading(bool bRet) { sal_Int32 nIndex = nNameLength - nLinkTabNameLength; INetURLObject aINetURLObject(aDocURLBuffer.makeStringAndClear()); - if(aName == aLinkTabName.copy(nIndex, nLinkTabNameLength) && + if(aName.match( aLinkTabName, nIndex) && (aName[nIndex - 1] == '#') && // before the table name should be the # char !aINetURLObject.HasError()) // the docname should be a valid URL { |