diff options
| author | Eike Rathke <erack@redhat.com> | 2015-07-10 23:46:30 +0200 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-08-06 12:56:06 +0200 |
| commit | a233b121f9242540e1b646767b91f9e80edee1d6 (patch) | |
| tree | 99c91de051bc70f4cedaf02407701354cb22f6c8 /svl | |
| parent | fc3a8fe2c1dd9264c0a79290b4a2c526f536dfdf (diff) | |
fix string access out of bounds
Could happen with a malformed subformat string like "[<0-0".
Change-Id: I8eaab2bcb469d91432a41dc349060c273a6575a4
(cherry picked from commit f52aa4d13b7f262a4c54f4e554f45d64a545bce7)
Reviewed-on: https://gerrit.libreoffice.org/16939
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'svl')
| -rw-r--r-- | svl/source/numbers/zformat.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx index 5a7d557b866e..91bba556d5f4 100644 --- a/svl/source/numbers/zformat.cxx +++ b/svl/source/numbers/zformat.cxx @@ -697,7 +697,7 @@ SvNumberformat::SvNumberformat(OUString& rString, { fLimit2 = fNumber; } - if ( sBuff[nPos] == ']' ) + if ( nPos < sBuff.getLength() && sBuff[nPos] == ']' ) { nPos++; } |