1 files changed, 19 insertions, 9 deletions
diff --git a/chart2/source/tools/XMLRangeHelper.cxx b/chart2/source/tools/XMLRangeHelper.cxx
index cc4749deee1f..3c5ed38e3130 100644
--- a/chart2/source/tools/XMLRangeHelper.cxx
+++ b/chart2/source/tools/XMLRangeHelper.cxx
@@ -20,7 +20,9 @@
 #include <XMLRangeHelper.hxx>
 #include <rtl/character.hxx>
 #include <rtl/ustrbuf.hxx>
+#include <sal/log.hxx>
 #include <osl/diagnose.h>
+#include <o3tl/string_view.hxx>
 
 #include <algorithm>
 
@@ -103,7 +105,7 @@ void lcl_getXMLStringForCell( const ::chart::XMLRangeHelper::Cell & rCell, OUStr
 }
 
 void lcl_getSingleCellAddressFromXMLString(
-    const OUString& rXMLString,
+    std::u16string_view rXMLString,
     sal_Int32 nStartPos, sal_Int32 nEndPos,
     ::chart::XMLRangeHelper::Cell & rOutCell )
 {
@@ -111,15 +113,15 @@ void lcl_getSingleCellAddressFromXMLString(
     static const sal_Unicode aDollar( '$' );
     static const sal_Unicode aLetterA( 'A' );
 
-    OUString aCellStr = rXMLString.copy( nStartPos, nEndPos - nStartPos + 1 ).toAsciiUpperCase();
-    const sal_Unicode* pStrArray = aCellStr.getStr();
-    sal_Int32 nLength = aCellStr.getLength();
-    sal_Int32 i = nLength - 1, nColumn = 0;
+    std::u16string_view aCellStr = rXMLString.substr( nStartPos, nEndPos - nStartPos + 1 );
+    const sal_Unicode* pStrArray = aCellStr.data();
+    sal_Int32 nLength = aCellStr.size();
+    sal_Int32 i = nLength - 1;
 
     // parse number for row
     while( rtl::isAsciiDigit( pStrArray[ i ] ) && i >= 0 )
         i--;
-    rOutCell.nRow = (aCellStr.copy( i + 1 )).toInt32() - 1;
+    rOutCell.nRow = (o3tl::toInt32(aCellStr.substr( i + 1 ))) - 1;
     // a dollar in XML means absolute (whereas in UI it means relative)
     if( pStrArray[ i ] == aDollar )
     {
@@ -130,13 +132,21 @@ void lcl_getSingleCellAddressFromXMLString(
         rOutCell.bRelativeRow = true;
 
     // parse rest for column
-    sal_Int32 nPower = 1;
-    while( rtl::isAsciiAlpha( pStrArray[ i ] ))
+    assert(i <= 13);
+    sal_Int64 nPower = 1;
+    sal_Int64 nColumn = 0;
+    while( i >= 0 && rtl::isAsciiAlpha( pStrArray[ i ] ))
     {
-        nColumn += (pStrArray[ i ] - aLetterA + 1) * nPower;
+        nColumn += (rtl::toAsciiUpperCase(pStrArray[ i ]) - aLetterA + 1) * nPower;
         i--;
         nPower *= 26;
     }
+    if (nColumn < SAL_MIN_INT32 || nColumn > SAL_MAX_INT32)
+    {
+        SAL_WARN("chart2", "out of range column");
+        nColumn = 0;
+    }
+
     rOutCell.nColumn = nColumn - 1;
 
     rOutCell.bRelativeColumn = true;