[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/ww8/ww8par2.cxx |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

New commits:
commit bc71cd3d645474aba462dcc524a0f93721374af6
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Nov 6 14:18:01 2013 +0000

    avoid out of bounds string access
    
    as demonstrated by ooo110088-1.doc
    
    Change-Id: I1df32536c1eb78e3ba93885df78328fde894c186

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 829131d..d0ec6f3 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -344,12 +344,13 @@ sal_uInt16 SwWW8ImplReader::End_Ftn()
         SwTxtNode* pTNd = rNIdx.GetNode().GetTxtNode();
         if (pTNd && !pTNd->GetTxt().isEmpty() && !sChar.isEmpty())
         {
-            if (pTNd->GetTxt()[0] == sChar[0])
+            const OUString &rTxt = pTNd->GetTxt();
+            if (rTxt[0] == sChar[0])
             {
                 pPaM->GetPoint()->nContent.Assign( pTNd, 0 );
                 pPaM->SetMark();
                 // Strip out tabs we may have inserted on export #i24762#
-                if (pTNd->GetTxt()[1] == 0x09)
+                if (rTxt.getLength() > 1 && rTxt[1] == 0x09)
                     pPaM->GetMark()->nContent++;
                 pPaM->GetMark()->nContent++;
                 pReffingStck->Delete(*pPaM);