More OUString::copy out-of-bounds fixes

Change-Id: I45762d167d04252e32155a7b23a3290688bccdf6

5 files changed, 28 insertions, 18 deletions

diff --git a/sfx2/source/appl/linkmgr2.cxx b/sfx2/source/appl/linkmgr2.cxx
index 0faf85372adc..a49d49b087c0 100644
--- a/sfx2/source/appl/linkmgr2.cxx
+++ b/sfx2/source/appl/linkmgr2.cxx
@@ -246,7 +246,7 @@ bool LinkManager::GetDisplayNames( const SvBaseLink * pLink,
                     if( pLinkStr )
                         *pLinkStr = sRange;
                     if( pFilter )
-                        *pFilter = sLNm.copy( nPos );
+                        *pFilter = nPos == -1 ? OUString() : sLNm.copy(nPos);
 
                     if( pType )
                     {
diff --git a/starmath/source/parse.cxx b/starmath/source/parse.cxx
index 2302087900bb..5a79bbb7cd11 100644
--- a/starmath/source/parse.cxx
+++ b/starmath/source/parse.cxx
@@ -441,7 +441,7 @@ void SmParser::NextToken()
         }
         else if (aRes.TokenType & KParseType::ONE_SINGLE_CHAR)
         {
-            if (nRealStart + 2 <= nBufLen && m_aBufferString.copy(nRealStart, 2) == "%%")
+            if (nRealStart + 2 <= nBufLen && m_aBufferString.match("%%", nRealStart))
             {
                 //SkipComment
                 m_nBufferIndex = nRealStart + 2;
@@ -543,7 +543,7 @@ void SmParser::NextToken()
             {
                 case '<':
                     {
-                        if (m_aBufferString.copy(nRealStart, 2) == "<<")
+                        if (m_aBufferString.match("<<", nRealStart))
                         {
                             m_aCurToken.eType    = TLL;
                             m_aCurToken.cMathChar = MS_LL;
@@ -553,7 +553,7 @@ void SmParser::NextToken()
 
                             rnEndPos = nRealStart + 2;
                         }
-                        else if (m_aBufferString.copy(nRealStart, 2) == "<=")
+                        else if (m_aBufferString.match("<=", nRealStart))
                         {
                             m_aCurToken.eType    = TLE;
                             m_aCurToken.cMathChar = MS_LE;
@@ -563,7 +563,7 @@ void SmParser::NextToken()
 
                             rnEndPos = nRealStart + 2;
                         }
-                        else if (m_aBufferString.copy(nRealStart, 2) == "<>")
+                        else if (m_aBufferString.match("<>", nRealStart))
                         {
                             m_aCurToken.eType    = TNEQ;
                             m_aCurToken.cMathChar = MS_NEQ;
@@ -573,7 +573,7 @@ void SmParser::NextToken()
 
                             rnEndPos = nRealStart + 2;
                         }
-                        else if (m_aBufferString.copy(nRealStart, 3) == "<?>")
+                        else if (m_aBufferString.match("<?>", nRealStart))
                         {
                             m_aCurToken.eType    = TPLACE;
                             m_aCurToken.cMathChar = MS_PLACE;
@@ -595,7 +595,7 @@ void SmParser::NextToken()
                     break;
                 case '>':
                     {
-                        if (m_aBufferString.copy(nRealStart, 2) == ">=")
+                        if (m_aBufferString.match(">=", nRealStart))
                         {
                             m_aCurToken.eType    = TGE;
                             m_aCurToken.cMathChar = MS_GE;
@@ -605,7 +605,7 @@ void SmParser::NextToken()
 
                             rnEndPos = nRealStart + 2;
                         }
-                        else if (m_aBufferString.copy(nRealStart, 2) == ">>")
+                        else if (m_aBufferString.match(">>", nRealStart))
                         {
                             m_aCurToken.eType    = TGG;
                             m_aCurToken.cMathChar = MS_GG;
@@ -770,7 +770,7 @@ void SmParser::NextToken()
                     break;
                 case '#':
                     {
-                        if (m_aBufferString.copy(nRealStart, 2) == "##")
+                        if (m_aBufferString.match("##", nRealStart))
                         {
                             m_aCurToken.eType    = TDPOUND;
                             m_aCurToken.cMathChar = '\0';
@@ -828,7 +828,7 @@ void SmParser::NextToken()
                     break;
                 case '+':
                     {
-                        if (m_aBufferString.copy(nRealStart, 2) == "+-")
+                        if (m_aBufferString.match("+-", nRealStart))
                         {
                             m_aCurToken.eType    = TPLUSMINUS;
                             m_aCurToken.cMathChar = MS_PLUSMINUS;
@@ -850,7 +850,7 @@ void SmParser::NextToken()
                     break;
                 case '-':
                     {
-                        if (m_aBufferString.copy(nRealStart, 2) == "-+")
+                        if (m_aBufferString.match("-+", nRealStart))
                         {
                             m_aCurToken.eType    = TMINUSPLUS;
                             m_aCurToken.cMathChar = MS_MINUSPLUS;
diff --git a/vcl/source/control/field2.cxx b/vcl/source/control/field2.cxx
index fa3fee23d5cb..162dfff25560 100644
--- a/vcl/source/control/field2.cxx
+++ b/vcl/source/control/field2.cxx
@@ -19,6 +19,8 @@
 
 #include "sal/config.h"
 
+#include <algorithm>
+
 #include <tools/diagnose_ex.h>
 #include <comphelper/processfactory.hxx>
 #include <comphelper/string.hxx>
@@ -1015,7 +1017,7 @@ static sal_uInt16 ImplCutNumberFromString( OUString& rStr )
         ++i2;
     }
     sal_Int32 nValue = rStr.copy(i1, i2-i1).toInt32();
-    rStr = rStr.copy(i2+1);
+    rStr = rStr.copy(std::min(i2+1, rStr.getLength()));
     return nValue;
 }
 
diff --git a/vcl/source/filter/wmf/emfwr.cxx b/vcl/source/filter/wmf/emfwr.cxx
index bc1fee3c0ad0..b628cd872247 100644
--- a/vcl/source/filter/wmf/emfwr.cxx
+++ b/vcl/source/filter/wmf/emfwr.cxx
@@ -17,6 +17,10 @@
  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  */
 
+#include "sal/config.h"
+
+#include <algorithm>
+
 #include "emfwr.hxx"
 #include <rtl/strbuf.hxx>
 #include <tools/helpers.hxx>
@@ -1353,7 +1357,7 @@ void EMFWriter::ImplWrite( const GDIMetaFile& rMtf )
             case META_TEXT_ACTION:
             {
                 const MetaTextAction*   pA = (const MetaTextAction*) pAction;
-                const OUString          aText = pA->GetText().copy( pA->GetIndex(), pA->GetLen() );
+                const OUString          aText = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
 
                 ImplCheckTextAttr();
                 ImplWriteTextRecord( pA->GetPoint(), aText, NULL, 0 );
@@ -1373,7 +1377,7 @@ void EMFWriter::ImplWrite( const GDIMetaFile& rMtf )
             case META_TEXTARRAY_ACTION:
             {
                 const MetaTextArrayAction*  pA = (const MetaTextArrayAction*) pAction;
-                const OUString              aText = pA->GetText().copy( pA->GetIndex(), pA->GetLen() );
+                const OUString              aText = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
 
                 ImplCheckTextAttr();
                 ImplWriteTextRecord( pA->GetPoint(), aText, pA->GetDXArray(), 0 );
@@ -1383,7 +1387,7 @@ void EMFWriter::ImplWrite( const GDIMetaFile& rMtf )
             case META_STRETCHTEXT_ACTION:
             {
                 const MetaStretchTextAction*    pA = (const MetaStretchTextAction*) pAction;
-                const OUString                  aText = pA->GetText().copy( pA->GetIndex(), pA->GetLen() );
+                const OUString                  aText = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
 
                 ImplCheckTextAttr();
                 ImplWriteTextRecord( pA->GetPoint(), aText, NULL, pA->GetWidth() );
diff --git a/vcl/source/filter/wmf/wmfwr.cxx b/vcl/source/filter/wmf/wmfwr.cxx
index d69bd8fc5207..3dc415bd2223 100644
--- a/vcl/source/filter/wmf/wmfwr.cxx
+++ b/vcl/source/filter/wmf/wmfwr.cxx
@@ -17,6 +17,10 @@
  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  */
 
+#include "sal/config.h"
+
+#include <algorithm>
+
 #include "wmfwr.hxx"
 #include <unotools/fontcvt.hxx>
 #include "emfwr.hxx"
@@ -1182,7 +1186,7 @@ void WMFWriter::WriteRecords( const GDIMetaFile & rMTF )
                 case META_TEXT_ACTION:
                 {
                     const MetaTextAction * pA = (const MetaTextAction*) pMA;
-                    OUString aTemp = pA->GetText().copy( pA->GetIndex(), pA->GetLen() );
+                    OUString aTemp = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
                     aSrcLineInfo = LineInfo();
                     SetAllAttr();
                     if ( !WMFRecord_Escape_Unicode( pA->GetPoint(), aTemp, NULL ) )
@@ -1194,7 +1198,7 @@ void WMFWriter::WriteRecords( const GDIMetaFile & rMTF )
                 {
                     const MetaTextArrayAction* pA = (const MetaTextArrayAction*) pMA;
 
-                    OUString aTemp = pA->GetText().copy( pA->GetIndex(), pA->GetLen() );
+                    OUString aTemp = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
                     aSrcLineInfo = LineInfo();
                     SetAllAttr();
                     if ( !WMFRecord_Escape_Unicode( pA->GetPoint(), aTemp, pA->GetDXArray() ) )
@@ -1205,7 +1209,7 @@ void WMFWriter::WriteRecords( const GDIMetaFile & rMTF )
                 case META_STRETCHTEXT_ACTION:
                 {
                     const MetaStretchTextAction* pA = (const MetaStretchTextAction *) pMA;
-                    OUString aTemp = pA->GetText().copy( pA->GetIndex(), pA->GetLen() );
+                    OUString aTemp = pA->GetText().copy( pA->GetIndex(), std::min<sal_Int32>(pA->GetText().getLength() - pA->GetIndex(), pA->GetLen()) );
 
                     sal_uInt16 nLen,i;
                     sal_Int32 nNormSize;