From 5f2a69740af96f36d32093026059b9d0d2ea6fb0 Mon Sep 17 00:00:00 2001
From: Eike Rathke <erack@redhat.com>
Date: Fri, 10 Jul 2015 23:46:30 +0200
Subject: fix string access out of bounds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Could happen with a malformed subformat string like "[<0-0".

Change-Id: I8eaab2bcb469d91432a41dc349060c273a6575a4
(cherry picked from commit f52aa4d13b7f262a4c54f4e554f45d64a545bce7)
Reviewed-on: https://gerrit.libreoffice.org/16939
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 svl/source/numbers/zformat.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'svl')

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 5a7d557b866e..91bba556d5f4 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -697,7 +697,7 @@ SvNumberformat::SvNumberformat(OUString& rString,
                     {
                         fLimit2 = fNumber;
                     }
-                    if ( sBuff[nPos] == ']' )
+                    if ( nPos < sBuff.getLength() && sBuff[nPos] == ']' )
                     {
                         nPos++;
                     }
-- 
cgit v1.2.3