summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Stahl <mstahl@redhat.com>2014-01-14 16:32:20 +0100
committerMichael Stahl <mstahl@redhat.com>2014-01-15 13:17:39 +0000
commit7ed845ae5682fdafb3390df85144388e240ccb89 (patch)
tree04d89ca03587bf56cf33b833d86dc940e1b4f287
parent2158a26f25b67fdd2564d2e01c2a0a720ef7f2e1 (diff)
fdo#73095: fix invalid access in SwFntObj::DrawText()
aStr may be 1 larger than pKernArray. Trivial fix by checking the largest index; not sure if it would be a good idea to allocate pKernArray with the larger size in the first place, but that would be a bigger change... (regression from 02ce734450559c9353ca7f42b2519239220dd265) Change-Id: Ia33feab001c34e85066b7596d8873f41588984e9 (cherry picked from commit 61ec8f086ba314b86c80a02b16072e88774abf6c) Reviewed-on: https://gerrit.libreoffice.org/7427 Reviewed-by: Michael Meeks <michael.meeks@collabora.com> Tested-by: Michael Meeks <michael.meeks@collabora.com>
-rw-r--r--sw/source/core/txtnode/fntcache.cxx5
1 files changed, 4 insertions, 1 deletions
diff --git a/sw/source/core/txtnode/fntcache.cxx b/sw/source/core/txtnode/fntcache.cxx
index 0ccbbc66fe6a..a518e1c53755 100644
--- a/sw/source/core/txtnode/fntcache.cxx
+++ b/sw/source/core/txtnode/fntcache.cxx
@@ -1573,8 +1573,11 @@ void SwFntObj::DrawText( SwDrawTextInfo &rInf )
/* fdo#72488 Hack: try to see if the space is zero width
* and don't bother with inserting a bullet in this case.
*/
- if (pKernArray[i + nCopyStart] != pKernArray[ i + nCopyStart + 1])
+ if ((i + nCopyStart + 1 >= rInf.GetLen()) ||
+ pKernArray[i + nCopyStart] != pKernArray[ i + nCopyStart + 1])
+ {
aStr = aStr.replaceAt(i, 1, OUString(CH_BULLET));
+ }
}
}