[Libreoffice-commits] core.git: cui/source svl/source

[Eike Rathke]

 cui/source/tabpages/numfmt.cxx |   18 +++++++++++++++---
 svl/source/numbers/zformat.cxx |   14 ++++++++++++--
 2 files changed, 27 insertions(+), 5 deletions(-)

New commits:
commit 839cc63e7d1b78c56e04bafb46037e898ce2c455
Author: Eike Rathke <erack at redhat.com>
Date:   Mon Aug 18 14:09:20 2014 +0200

    prevent out-of-bounds string access
    
    ... while entering a   *   star symbol format code and there's no fill
    character following the * yet.
    
    Change-Id: I006f125ceefccba6a95ea033fd434d98e5d4f1c2

diff --git a/cui/source/tabpages/numfmt.cxx b/cui/source/tabpages/numfmt.cxx
index c235cfa..1577c2a 100644
--- a/cui/source/tabpages/numfmt.cxx
+++ b/cui/source/tabpages/numfmt.cxx
@@ -113,9 +113,21 @@ void SvxNumberPreview::NotifyChange( const OUString& rPrevStr,
     mnPos = aPrevStr.indexOf( 0x1B );
     if ( mnPos != -1 )
     {
-        mnChar = aPrevStr[ mnPos + 1 ];
-        // delete placeholder and char to repeat
-        aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" );
+        // Right during user input the star symbol is the very
+        // last character before the user enters another one.
+        if (mnPos < aPrevStr.getLength() - 1)
+        {
+            mnChar = aPrevStr[ mnPos + 1 ];
+            // delete placeholder and char to repeat
+            aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" );
+        }
+        else
+        {
+            // delete placeholder
+            aPrevStr = aPrevStr.replaceAt( mnPos, 1, "" );
+            // do not attempt to draw a 0 fill character
+            mnPos = -1;
+        }
     }
     svtools::ColorConfig aColorConfig;
     Color aWindowTextColor( aColorConfig.GetColorValue( svtools::FONTCOLOR ).nColor );
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 5815cac..69e0059 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -2590,8 +2590,18 @@ bool SvNumberformat::GetOutputString(double fNumber,
                     if( bStarFlag )
                     {
                         sBuff.append((sal_Unicode) 0x1B);
-                        sBuff.append(rInfo.sStrArray[i][1]);
-                        bRes = true;
+                        const OUString& rStr =rInfo.sStrArray[i];
+                        // Right during user input the star symbol is the very
+                        // last character before the user enters another one.
+                        if (rStr.getLength() > 1)
+                        {
+                            sBuff.append(rStr[1]);
+                            bRes = true;
+                        }
+                        else
+                        {
+                            bRes = false;
+                        }
                     }
                     break;
                 case NF_SYMBOLTYPE_BLANK: