summaryrefslogtreecommitdiff
path: root/sc/source/core/tool/compiler.cxx
diff options
context:
space:
mode:
authorEike Rathke <erack@redhat.com>2014-08-22 00:11:18 +0200
committerEike Rathke <erack@redhat.com>2014-08-22 00:16:15 +0200
commit07b18860ae03ecb66b5605201f34c2aef3a55ad6 (patch)
treee7c1f3380a30efa3763515c3d4aa6f2d389423ca /sc/source/core/tool/compiler.cxx
parent9df3a83c304f3dd0e0233d234dc6036ab5eefb77 (diff)
out-of-bounds string access
... when parsing ='foo'# with no character following. Change-Id: Id65fce721cb47a4d3c947c677323bdcaa2ce957f
Diffstat (limited to 'sc/source/core/tool/compiler.cxx')
-rw-r--r--sc/source/core/tool/compiler.cxx2
1 files changed, 1 insertions, 1 deletions
diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx
index 93d8f1925709..8c3e485991de 100644
--- a/sc/source/core/tool/compiler.cxx
+++ b/sc/source/core/tool/compiler.cxx
@@ -426,7 +426,7 @@ static bool lcl_isValidQuotedText( const OUString& rFormula, sal_Int32 nSrcPos,
// but '' marks an escaped '
// We've earlier guaranteed that a string containing '' will be
// surrounded by '
- if (rFormula[nSrcPos] == '\'')
+ if (nSrcPos < rFormula.getLength() && rFormula[nSrcPos] == '\'')
{
sal_Int32 nPos = nSrcPos+1;
while (nPos < rFormula.getLength())