svl/source/numbers/zforscan.cxx | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
New commits: commit 73d241d9b876bf464176878d76ae6f6497341a13 Author: Eike Rathke <[email protected]> Date: Fri Mar 10 13:48:24 2017 +0100 prevent string access out of bounds Though only the closing 0-character and the following check excludes that, dbgutil asserts. (cherry picked from commit c407fff205a270e02fe07885805b7250e71c28f8) Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7 Reviewed-on: https://gerrit.libreoffice.org/35044 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx index 228afe76d628..9bc8326656df 100644 --- a/svl/source/numbers/zforscan.cxx +++ b/svl/source/numbers/zforscan.cxx @@ -836,18 +836,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr, switch (cToken) { case '/': // AM/PM, A/P - cNext = rStr[nPos]; - if ( cNext == 'P' || cNext == 'p' ) + if (nPos < rStr.getLength()) { - sal_Int32 nLen = sSymbol.getLength(); - if ( 1 <= nLen && - (sSymbol[0] == 'A' || sSymbol[0] == 'a') && - (nLen == 1 || - (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') - && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + cNext = rStr[nPos]; + if ( cNext == 'P' || cNext == 'p' ) { - sSymbol += OUString(cToken); - bDontStop = true; + sal_Int32 nLen = sSymbol.getLength(); + if ( 1 <= nLen && + (sSymbol[0] == 'A' || sSymbol[0] == 'a') && + (nLen == 1 || + (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm') + && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm')))) + { + sSymbol += OUString(cToken); + bDontStop = true; + } } } break;
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
