[Libreoffice-commits] core.git: Branch 'libreoffice-4-2' - sc/source

[Eike Rathke]

 sc/source/ui/app/inputhdl.cxx |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

New commits:
commit 6f2c7baccd4835508582abc429ca70c3e12a7496
Author: Eike Rathke <erack at redhat.com>
Date:   Thu Dec 5 20:28:29 2013 +0100

    fixed out of bounds string access
    
    Change-Id: I25f53f16c3ddc3456c165b6c604911433f460228
    (cherry picked from commit 40fba2316ac3ebb11b69c157cfac7da92a63821b)

diff --git a/sc/source/ui/app/inputhdl.cxx b/sc/source/ui/app/inputhdl.cxx
index 8001e67..f0f6cf8 100644
--- a/sc/source/ui/app/inputhdl.cxx
+++ b/sc/source/ui/app/inputhdl.cxx
@@ -1249,11 +1249,15 @@ static void lcl_CompleteFunction( EditView* pView, const OUString& rInsert, bool
 
             ESelection aWordSel = pView->GetSelection();
             OUString aOld = pView->GetEditEngine()->GetText(0);
-            sal_Unicode cNext = aOld[aWordSel.nEndPos];
-            if ( cNext == '(' )
+            // aWordSel.EndPos points one behind string if word at end.
+            if (aWordSel.nEndPos < aOld.getLength())
             {
-                bDoParen = false;
-                aInsStr = aInsStr.copy( 0, nInsLen - 2 );   // Klammern weglassen
+                sal_Unicode cNext = aOld[aWordSel.nEndPos];
+                if ( cNext == '(' )
+                {
+                    bDoParen = false;
+                    aInsStr = aInsStr.copy( 0, nInsLen - 2 );   // Klammern weglassen
+                }
             }
         }