diff options
| author | Eike Rathke <erack@redhat.com> | 2014-08-27 00:30:01 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2014-08-27 00:34:43 +0200 |
| commit | aebcabd54cc5587f3856c48db0a4c4fc0f3f8ce8 (patch) | |
| tree | 578c8716f0550170bb3381e2f50a5567d89eb10f /sc/source | |
| parent | dfb48f77ba011661e03b6eb942234adb4e6630d7 (diff) | |
out-of-bounds string access, this comparison never matched
aName == aLinkTabName.copy(nIndex, nLinkTabNameLength)
is not a replacement for
String(aName).Equals(String(aLinkTabName), nIndex, nLinkTabNameLength)
instead use
aName.match( aLinkTabName, nIndex)
because here nLinkTabNameLength actually is aLinkTabName.getLength()
Change-Id: I884f56541f819db5672e9d096a26a3673e82d83b
Diffstat (limited to 'sc/source')
| -rw-r--r-- | sc/source/ui/docshell/docsh.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx index 29f6e5a51157..7c4721284eb1 100644 --- a/sc/source/ui/docshell/docsh.cxx +++ b/sc/source/ui/docshell/docsh.cxx @@ -318,7 +318,7 @@ void ScDocShell::AfterXMLLoading(bool bRet) { sal_Int32 nIndex = nNameLength - nLinkTabNameLength; INetURLObject aINetURLObject(aDocURLBuffer.makeStringAndClear()); - if(aName == aLinkTabName.copy(nIndex, nLinkTabNameLength) && + if(aName.match( aLinkTabName, nIndex) && (aName[nIndex - 1] == '#') && // before the table name should be the # char !aINetURLObject.HasError()) // the docname should be a valid URL { |