[Libreoffice-commits] core.git: sc/source

[Eike Rathke]

 sc/source/ui/app/inputhdl.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit f46cb0c45a3e00057c1bcf73ac850ef44d470b9d
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Oct 16 21:52:18 2013 +0200

    fixed out-of-bounds OUString access
    
    Change-Id: I971c339f2cb4cddcf4fbb447eb79282d34979220

diff --git a/sc/source/ui/app/inputhdl.cxx b/sc/source/ui/app/inputhdl.cxx
index 72bfec8..c35d3d6 100644
--- a/sc/source/ui/app/inputhdl.cxx
+++ b/sc/source/ui/app/inputhdl.cxx
@@ -956,7 +956,8 @@ void ScInputHandler::ShowTipCursor()
                 {
                     sal_uInt16 nPosition = 0;
                     OUString aText = pEngine->GetWord( 0, aSel.nEndPos-1 );
-                    if( aText[ aSel.nEndPos-1 ] == '=' )
+                    /* XXX: dubious, what is this condition supposed to exactly match? */
+                    if (aSel.nEndPos <= aText.getLength() && aText[ aSel.nEndPos-1 ] == '=')
                     {
                         break;
                     }