fdo#51916 out of bounds substring access

Change-Id: I7db46ef17b8aed443faa7eb0c13b6ba109242cc1

1 files changed, 6 insertions, 3 deletions

diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 0714b1579a68..d10a5a0b7951 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -3940,11 +3940,14 @@ int RTFDocumentImpl::popState()
                 // extract default text
                 nLength = aStr.toChar();
                 aStr = aStr.copy(1);
-                OString aDefaultText = aStr.copy(0, nLength);
                 RTFValue::Pointer_t pNValue(new RTFValue(OStringToOUString(aName, aState.nCurrentEncoding)));
                 m_aFormfieldSprms.set(NS_ooxml::LN_CT_FFData_name, pNValue);
-                RTFValue::Pointer_t pDValue(new RTFValue(OStringToOUString(aDefaultText, aState.nCurrentEncoding)));
-                m_aFormfieldSprms.set(NS_ooxml::LN_CT_FFTextInput_default, pDValue);
+                if (nLength > 0)
+                {
+                    OString aDefaultText = aStr.copy(0, nLength);
+                    RTFValue::Pointer_t pDValue(new RTFValue(OStringToOUString(aDefaultText, aState.nCurrentEncoding)));
+                    m_aFormfieldSprms.set(NS_ooxml::LN_CT_FFTextInput_default, pDValue);
+                }
 
                 m_bFormField = false;
             }