diff options
| author | Eike Rathke <erack@redhat.com> | 2014-08-27 00:30:01 +0200 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2014-09-15 17:07:44 +0200 |
| commit | 47c4ac403d8eec73d0aeb991c96abe569fa55d91 (patch) | |
| tree | 9c033edc82482caa4c874ae467c4b35d4b2a3b24 /sc | |
| parent | 6f07a8b30df2eb5f4c4b4e7fb8be8deec9e114e8 (diff) | |
out-of-bounds string access, this comparison never matched
aName == aLinkTabName.copy(nIndex, nLinkTabNameLength)
is not a replacement for
String(aName).Equals(String(aLinkTabName), nIndex, nLinkTabNameLength)
instead use
aName.match( aLinkTabName, nIndex)
because here nLinkTabNameLength actually is aLinkTabName.getLength()
Change-Id: I884f56541f819db5672e9d096a26a3673e82d83b
(cherry picked from commit aebcabd54cc5587f3856c48db0a4c4fc0f3f8ce8)
Reviewed-on: https://gerrit.libreoffice.org/11134
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/ui/docshell/docsh.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx index e3b94d7527e0..c796d6deb123 100644 --- a/sc/source/ui/docshell/docsh.cxx +++ b/sc/source/ui/docshell/docsh.cxx @@ -327,7 +327,7 @@ void ScDocShell::AfterXMLLoading(sal_Bool bRet) { xub_StrLen nIndex = nNameLength - nLinkTabNameLength; INetURLObject aINetURLObject(aDocURLBuffer.makeStringAndClear()); - if(aName == aLinkTabName.copy(nIndex, nLinkTabNameLength) && + if(aName.match( aLinkTabName, nIndex) && (aName[nIndex - 1] == '#') && // before the table name should be the # char !aINetURLObject.HasError()) // the docname should be a valid URL { |