summaryrefslogtreecommitdiff
path: root/svl/source
diff options
context:
space:
mode:
authorEike Rathke <erack@redhat.com>2015-07-10 23:46:30 +0200
committerCaolán McNamara <caolanm@redhat.com>2015-07-11 19:57:39 +0000
commit5f2a69740af96f36d32093026059b9d0d2ea6fb0 (patch)
treefdd584024933e82ee366c6da3011ac09e64a1416 /svl/source
parente728c26e7449b9a672ff0efa8098e4eda3d1ffc0 (diff)
fix string access out of bounds
Could happen with a malformed subformat string like "[<0-0". Change-Id: I8eaab2bcb469d91432a41dc349060c273a6575a4 (cherry picked from commit f52aa4d13b7f262a4c54f4e554f45d64a545bce7) Reviewed-on: https://gerrit.libreoffice.org/16939 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'svl/source')
-rw-r--r--svl/source/numbers/zformat.cxx2
1 files changed, 1 insertions, 1 deletions
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 5a7d557b866e..91bba556d5f4 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -697,7 +697,7 @@ SvNumberformat::SvNumberformat(OUString& rString,
{
fLimit2 = fNumber;
}
- if ( sBuff[nPos] == ']' )
+ if ( nPos < sBuff.getLength() && sBuff[nPos] == ']' )
{
nPos++;
}