diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2013-11-06 14:18:01 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2013-11-06 14:18:07 +0000 |
| commit | bc71cd3d645474aba462dcc524a0f93721374af6 (patch) | |
| tree | 1a2539f3f46c865d128946efba07c3bb8491eca3 /sw | |
| parent | 9649cb574f9416ca4061ebed6f1538438cb55cb0 (diff) | |
avoid out of bounds string access
as demonstrated by ooo110088-1.doc
Change-Id: I1df32536c1eb78e3ba93885df78328fde894c186
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8par2.cxx | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx index 829131d83be2..d0ec6f317893 100644 --- a/sw/source/filter/ww8/ww8par2.cxx +++ b/sw/source/filter/ww8/ww8par2.cxx @@ -344,12 +344,13 @@ sal_uInt16 SwWW8ImplReader::End_Ftn() SwTxtNode* pTNd = rNIdx.GetNode().GetTxtNode(); if (pTNd && !pTNd->GetTxt().isEmpty() && !sChar.isEmpty()) { - if (pTNd->GetTxt()[0] == sChar[0]) + const OUString &rTxt = pTNd->GetTxt(); + if (rTxt[0] == sChar[0]) { pPaM->GetPoint()->nContent.Assign( pTNd, 0 ); pPaM->SetMark(); // Strip out tabs we may have inserted on export #i24762# - if (pTNd->GetTxt()[1] == 0x09) + if (rTxt.getLength() > 1 && rTxt[1] == 0x09) pPaM->GetMark()->nContent++; pPaM->GetMark()->nContent++; pReffingStck->Delete(*pPaM); |