[Libreoffice-commits] core.git: Branch 'libreoffice-3-6' - sc/source

[Kohei Yoshida]

 sc/source/core/tool/reffind.cxx |    5 +++++
 1 file changed, 5 insertions(+)

New commits:
commit 03158229fdfda1003d072853610fbfbe433b8be9
Author: Kohei Yoshida <kohei.yoshida at gmail.com>
Date:   Tue Feb 5 15:23:44 2013 -0500

    fdo#39135: Prevent integer overflow & update the character during loop.
    
    These two errors in the code contributed to the reported bug.  Let's
    fix them.
    
    Change-Id: If82a1bd4d1e27145b48e722b30388cc9dc4a8a6e
    Reviewed-on: https://gerrit.libreoffice.org/2008
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/core/tool/reffind.cxx b/sc/source/core/tool/reffind.cxx
index 660bab0..c8e1722 100644
--- a/sc/source/core/tool/reffind.cxx
+++ b/sc/source/core/tool/reffind.cxx
@@ -169,15 +169,20 @@ void ExpandToTextR1C1(const sal_Unicode* p, xub_StrLen nLen, xub_StrLen& rStartP
                     if (c == '\'')
                         break;
                 }
+                if (rStartPos == 0)
+                    break;
             }
             else if (c == ']')
             {
                 // Skip until the opening braket.
                 for (--rStartPos; rStartPos > 0; --rStartPos)
                 {
+                    c = p[rStartPos];
                     if (c == '[')
                         break;
                 }
+                if (rStartPos == 0)
+                    break;
             }
             else if (!IsText(c))
             {