diff options
| author | Eike Rathke <erack@redhat.com> | 2015-07-10 23:46:30 +0200 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-07-11 19:57:39 +0000 |
| commit | 5f2a69740af96f36d32093026059b9d0d2ea6fb0 (patch) | |
| tree | fdd584024933e82ee366c6da3011ac09e64a1416 /svl | |
| parent | e728c26e7449b9a672ff0efa8098e4eda3d1ffc0 (diff) | |
fix string access out of bounds
Could happen with a malformed subformat string like "[<0-0".
Change-Id: I8eaab2bcb469d91432a41dc349060c273a6575a4
(cherry picked from commit f52aa4d13b7f262a4c54f4e554f45d64a545bce7)
Reviewed-on: https://gerrit.libreoffice.org/16939
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'svl')
| -rw-r--r-- | svl/source/numbers/zformat.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx index 5a7d557b866e..91bba556d5f4 100644 --- a/svl/source/numbers/zformat.cxx +++ b/svl/source/numbers/zformat.cxx @@ -697,7 +697,7 @@ SvNumberformat::SvNumberformat(OUString& rString, { fLimit2 = fNumber; } - if ( sBuff[nPos] == ']' ) + if ( nPos < sBuff.getLength() && sBuff[nPos] == ']' ) { nPos++; } |