[Libreoffice-commits] .: sc/source

[Eike Rathke]

 sc/source/ui/dbgui/csvgrid.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 21cb8210c74e52896ce7fb063f1578b13672f4bd
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Aug 1 13:46:25 2012 +0200

    resolved fdo#53012 crash in CSV fixed width import
    
    8cd05e9cf1152b21528c6f1a5bda3d949dc49791 changed from using String to
    OUString. ScCsvGrid::ImplSetTextLineFix() attempted to copy excess
    characters (always CSV_MAXSTRLEN if greater than field width) where
    String::Copy() silently ignored the excess length but OUString::copy()
    may result in invalid memory accesses and asserts in dbgutil build.
    
    Change-Id: Ic9f7f38d6f2bbd770d6356e1304de8e39c09e30b

diff --git a/sc/source/ui/dbgui/csvgrid.cxx b/sc/source/ui/dbgui/csvgrid.cxx
index 5d99fb4..fbcecb7 100644
--- a/sc/source/ui/dbgui/csvgrid.cxx
+++ b/sc/source/ui/dbgui/csvgrid.cxx
@@ -806,7 +806,8 @@ void ScCsvGrid::ImplSetTextLineFix( sal_Int32 nLine, const rtl::OUString& rTextL
     for( sal_uInt32 nColIx = 0; (nColIx < nColCount) && (nStrIx < nStrLen); ++nColIx )
     {
         sal_Int32 nColWidth = GetColumnWidth( nColIx );
-        rStrVec.push_back( rTextLine.copy( nStrIx, Max( nColWidth, static_cast<sal_Int32>(CSV_MAXSTRLEN) ) ) );
+        sal_Int32 nLen = std::min( std::min( nColWidth, static_cast<sal_Int32>(CSV_MAXSTRLEN) ), nStrLen - nStrIx);
+        rStrVec.push_back( rTextLine.copy( nStrIx, nLen ) );
         nStrIx = nStrIx + nColWidth;
     }
     InvalidateGfx();