[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - sc/source

[Eike Rathke]

 sc/source/core/tool/compiler.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 0a9fb15268c938cc4e3cc69c222cec1849064679
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Aug 22 00:11:18 2014 +0200

    out-of-bounds string access
    
    ... when parsing  ='foo'#  with no character following.
    
    Change-Id: Id65fce721cb47a4d3c947c677323bdcaa2ce957f
    (cherry picked from commit 07b18860ae03ecb66b5605201f34c2aef3a55ad6)
    Reviewed-on: https://gerrit.libreoffice.org/11062
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx
index cd9bc4d..8031f8e 100644
--- a/sc/source/core/tool/compiler.cxx
+++ b/sc/source/core/tool/compiler.cxx
@@ -426,7 +426,7 @@ static bool lcl_isValidQuotedText( const OUString& rFormula, sal_Int32 nSrcPos,
     // but '' marks an escaped '
     // We've earlier guaranteed that a string containing '' will be
     // surrounded by '
-    if (rFormula[nSrcPos] == '\'')
+    if (nSrcPos < rFormula.getLength() && rFormula[nSrcPos] == '\'')
     {
         sal_Int32 nPos = nSrcPos+1;
         while (nPos < rFormula.getLength())