diff options
| author | Eike Rathke <erack@redhat.com> | 2017-03-10 13:48:24 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-03-21 16:33:22 +0000 |
| commit | 73d241d9b876bf464176878d76ae6f6497341a13 (patch) | |
| tree | 229ac3b334f6aadd941b23471edb59021be1468c | |
| parent | b816ad91b4cf6eeb30dff87859a8416cfdcbabbc (diff) | |
prevent string access out of bounds
Though only the closing 0-character and the following check excludes that,
dbgutil asserts.
(cherry picked from commit c407fff205a270e02fe07885805b7250e71c28f8)
Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7
Reviewed-on: https://gerrit.libreoffice.org/35044
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | svl/source/numbers/zforscan.cxx | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx index 228afe76d628..9bc8326656df 100644 --- a/svl/source/numbers/zforscan.cxx +++ b/svl/source/numbers/zforscan.cxx @@ -836,18 +836,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr, switch (cToken) { case '/': // AM/PM, A/P - cNext = rStr[nPos]; - if ( cNext == 'P' || cNext == 'p' ) + if (nPos < rStr.getLength()) { - sal_Int32 nLen = sSymbol.getLength(); - if ( 1 <= nLen && - (sSymbol[0] == 'A' || sSymbol[0] == 'a') && - (nLen == 1 || - (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') - && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + cNext = rStr[nPos]; + if ( cNext == 'P' || cNext == 'p' ) { - sSymbol += OUString(cToken); - bDontStop = true; + sal_Int32 nLen = sSymbol.getLength(); + if ( 1 <= nLen && + (sSymbol[0] == 'A' || sSymbol[0] == 'a') && + (nLen == 1 || + (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') + && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + { + sSymbol += OUString(cToken); + bDontStop = true; + } } } break; |