diff options
| author | Kohei Yoshida <kohei.yoshida@gmail.com> | 2013-02-05 15:23:44 -0500 |
|---|---|---|
| committer | Kohei Yoshida <kohei.yoshida@gmail.com> | 2013-02-05 15:30:33 -0500 |
| commit | 530bcf74fae4d576d7001a3b975134a48f1c9969 (patch) | |
| tree | 8693eb39747eb8fe5fc662d6cbb471e22f0c5adb /sc | |
| parent | 278b3534e3aa27b92f7d681f086cb071df75bffd (diff) | |
fdo#39135: Prevent integer overflow & update the character during loop.
These two errors in the code contributed to the reported bug. Let's
fix them.
Change-Id: If82a1bd4d1e27145b48e722b30388cc9dc4a8a6e
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/core/tool/reffind.cxx | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sc/source/core/tool/reffind.cxx b/sc/source/core/tool/reffind.cxx index 660bab082297..c8e1722ac6e2 100644 --- a/sc/source/core/tool/reffind.cxx +++ b/sc/source/core/tool/reffind.cxx @@ -169,15 +169,20 @@ void ExpandToTextR1C1(const sal_Unicode* p, xub_StrLen nLen, xub_StrLen& rStartP if (c == '\'') break; } + if (rStartPos == 0) + break; } else if (c == ']') { // Skip until the opening braket. for (--rStartPos; rStartPos > 0; --rStartPos) { + c = p[rStartPos]; if (c == '[') break; } + if (rStartPos == 0) + break; } else if (!IsText(c)) { |