[Libreoffice-commits] core.git: Branch 'libreoffice-4-1-3' - vcl/source

[Stephan Bergmann]

 vcl/source/control/field2.cxx |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

New commits:
commit 11974b31bc5f2718d9f4da47bf376ee37e57deeb
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Thu Oct 10 11:50:38 2013 +0200

    Prevent out-of-bounds arguments to OUString::copy
    
    ...which would somewhat unhelpfully result in returning "!!br0ken!!"
    
    (partial backport of 34e951bd7284d2e771c279e3adc3899d191fdad0 "More
    OUString::copy out-of-bounds fixes")
    
    Change-Id: Ibf66d218fe5f0d7b6216795a3b991705d4afda73
    Reviewed-on: https://gerrit.libreoffice.org/6185
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/source/control/field2.cxx b/vcl/source/control/field2.cxx
index 5ae0453..080d1fc 100644
--- a/vcl/source/control/field2.cxx
+++ b/vcl/source/control/field2.cxx
@@ -19,6 +19,8 @@
 
 #include "sal/config.h"
 
+#include <algorithm>
+
 #include <comphelper/processfactory.hxx>
 #include <comphelper/string.hxx>
 #include <tools/rc.h>
@@ -1013,7 +1015,7 @@ static sal_uInt16 ImplCutNumberFromString( OUString& rStr )
         ++i2;
     }
     sal_Int32 nValue = rStr.copy(i1, i2-i1).toInt32();
-    rStr = rStr.copy(i2+1);
+    rStr = rStr.copy(std::min(i2+1, rStr.getLength()));
     return nValue;
 }