svl/source/numbers/zformat.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit d04b79745e9a46f5bae5ccbdce3011da9a3c974d
Author:     Caolán McNamara <[email protected]>
AuthorDate: Wed Oct 10 09:42:36 2018 +0100
Commit:     Noel Grandin <[email protected]>
CommitDate: Thu Oct 18 16:19:05 2018 +0200

    ofz#10879 stay inside sSecStr bounds
    
    Change-Id: I0ca70cdb9b80305c5339668d65d2c4c9977e7160
    Reviewed-on: https://gerrit.libreoffice.org/61606
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 1d4fd993771a406c1ba12282e8b344beb61d994b)
    Reviewed-on: https://gerrit.libreoffice.org/61832
    Reviewed-by: Christian Lohmaier <[email protected]>
    Reviewed-by: Noel Grandin <[email protected]>
    Tested-by: Noel Grandin <[email protected]>

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index ee42209f4363..c42765160494 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -3046,7 +3046,7 @@ bool SvNumberformat::ImpGetTimeOutput(double fNumber,
                      (rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING ||
                       rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ?
                      nCntPost : rInfo.sStrArray[i].getLength() );
-            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++)
+            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < 
sSecStr.getLength(); ++j)
             {
                 sBuff.append(sSecStr[nSecPos]);
                 nSecPos++;
@@ -3873,7 +3873,7 @@ bool SvNumberformat::ImpGetDateTimeOutput(double fNumber,
                      (rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING ||
                       rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ?
                      nCntPost : rInfo.sStrArray[i].getLength() );
-            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++)
+            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < 
sSecStr.getLength(); ++j)
             {
                 sBuff.append(sSecStr[ nSecPos ]);
                 nSecPos++;
_______________________________________________
Libreoffice-commits mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

Reply via email to