diff options
author | Eike Rathke <erack@redhat.com> | 2014-08-27 00:30:01 +0200 |
---|---|---|
committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2014-08-27 01:11:08 -0500 |
commit | 100a21046a95a868f32b90dab48de1cd5781fcd9 (patch) | |
tree | d53692456d56521ed61eecc003623c8f7f65fd5c /sc/source/ui | |
parent | 150d3ae7f9d1d801e0a05e555781eba5a13d9eff (diff) |
out-of-bounds string access, this comparison never matched
aName == aLinkTabName.copy(nIndex, nLinkTabNameLength)
is not a replacement for
String(aName).Equals(String(aLinkTabName), nIndex, nLinkTabNameLength)
instead use
aName.match( aLinkTabName, nIndex)
because here nLinkTabNameLength actually is aLinkTabName.getLength()
Change-Id: I884f56541f819db5672e9d096a26a3673e82d83b
(cherry picked from commit aebcabd54cc5587f3856c48db0a4c4fc0f3f8ce8)
Reviewed-on: https://gerrit.libreoffice.org/11134
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Diffstat (limited to 'sc/source/ui')
-rw-r--r-- | sc/source/ui/docshell/docsh.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx index bfc94db4e381..71dfa0ae37c6 100644 --- a/sc/source/ui/docshell/docsh.cxx +++ b/sc/source/ui/docshell/docsh.cxx @@ -326,7 +326,7 @@ void ScDocShell::AfterXMLLoading(sal_Bool bRet) { xub_StrLen nIndex = nNameLength - nLinkTabNameLength; INetURLObject aINetURLObject(aDocURLBuffer.makeStringAndClear()); - if(aName == aLinkTabName.copy(nIndex, nLinkTabNameLength) && + if(aName.match( aLinkTabName, nIndex) && (aName[nIndex - 1] == '#') && // before the table name should be the # char !aINetURLObject.HasError()) // the docname should be a valid URL { |