diff options
| author | Eike Rathke <erack@redhat.com> | 2016-05-31 00:02:38 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2016-05-30 22:19:52 +0000 |
| commit | b20875755f9d5dd4e46acbb06b532d8522702651 (patch) | |
| tree | 19169c82d560c1c41d25294a725732e119b87179 /xmloff | |
| parent | bce5cdcc7f59da19c063205c6c79fc30874cb5ee (diff) | |
prevent out of bounds string access
Yet another reminiscence of String to OUString conversion..
where the terminating NULL-character was obtained and
SvNumberformat::InsertBlanks() effectively did nothing.
Could be triggered already by entering an '_' underscore character as
number format code, which is a place holder for blanks of the same width
as the following character, which there isn't then yet.
Change-Id: I0534e1417d4bd35e9e7ed4bd0170b9ea3b5fb575
(cherry picked from commit c75ce37560c05271ba56c9dd0d98c5001e83cc2f)
Reviewed-on: https://gerrit.libreoffice.org/25692
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>
Diffstat (limited to 'xmloff')
| -rw-r--r-- | xmloff/source/style/xmlnumfe.cxx | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/xmloff/source/style/xmlnumfe.cxx b/xmloff/source/style/xmlnumfe.cxx index 229237c2c309..c71779089b5d 100644 --- a/xmloff/source/style/xmlnumfe.cxx +++ b/xmloff/source/style/xmlnumfe.cxx @@ -1317,7 +1317,7 @@ void SvXMLNumFmtExport::ExportPart_Impl( const SvNumberformat& rFormat, sal_uInt { aEmbeddedStr = *pElemStr; } - else + else if (pElemStr->getLength() >= 2) { SvNumberformat::InsertBlanks( aEmbeddedStr, 0, (*pElemStr)[1] ); } @@ -1389,7 +1389,8 @@ void SvXMLNumFmtExport::ExportPart_Impl( const SvNumberformat& rFormat, sal_uInt // (#i20396# the spaces may also be in embedded-text elements) OUString aBlanks; - SvNumberformat::InsertBlanks( aBlanks, 0, (*pElemStr)[1] ); + if (pElemStr->getLength() >= 2) + SvNumberformat::InsertBlanks( aBlanks, 0, (*pElemStr)[1] ); AddToTextElement_Impl( aBlanks ); } break; |