From 100a21046a95a868f32b90dab48de1cd5781fcd9 Mon Sep 17 00:00:00 2001 From: Eike Rathke Date: Wed, 27 Aug 2014 00:30:01 +0200 Subject: out-of-bounds string access, this comparison never matched aName == aLinkTabName.copy(nIndex, nLinkTabNameLength) is not a replacement for String(aName).Equals(String(aLinkTabName), nIndex, nLinkTabNameLength) instead use aName.match( aLinkTabName, nIndex) because here nLinkTabNameLength actually is aLinkTabName.getLength() Change-Id: I884f56541f819db5672e9d096a26a3673e82d83b (cherry picked from commit aebcabd54cc5587f3856c48db0a4c4fc0f3f8ce8) Reviewed-on: https://gerrit.libreoffice.org/11134 Reviewed-by: Markus Mohrhard Tested-by: Markus Mohrhard --- sc/source/ui/docshell/docsh.cxx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sc/source/ui') diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx index bfc94db4e381..71dfa0ae37c6 100644 --- a/sc/source/ui/docshell/docsh.cxx +++ b/sc/source/ui/docshell/docsh.cxx @@ -326,7 +326,7 @@ void ScDocShell::AfterXMLLoading(sal_Bool bRet) { xub_StrLen nIndex = nNameLength - nLinkTabNameLength; INetURLObject aINetURLObject(aDocURLBuffer.makeStringAndClear()); - if(aName == aLinkTabName.copy(nIndex, nLinkTabNameLength) && + if(aName.match( aLinkTabName, nIndex) && (aName[nIndex - 1] == '#') && // before the table name should be the # char !aINetURLObject.HasError()) // the docname should be a valid URL { -- cgit v1.2.3