[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - sc/source

[Eike Rathke]

 sc/source/ui/docshell/docsh.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 5c1b508b172f0047d86e1acde92239ebf3438251
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Aug 27 00:30:01 2014 +0200

    out-of-bounds string access, this comparison never matched
    
    aName == aLinkTabName.copy(nIndex, nLinkTabNameLength)
    is not a replacement for
    String(aName).Equals(String(aLinkTabName), nIndex, nLinkTabNameLength)
    instead use
    aName.match( aLinkTabName, nIndex)
    because here nLinkTabNameLength actually is aLinkTabName.getLength()
    
    Change-Id: I884f56541f819db5672e9d096a26a3673e82d83b
    (cherry picked from commit aebcabd54cc5587f3856c48db0a4c4fc0f3f8ce8)
    Reviewed-on: https://gerrit.libreoffice.org/11133
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx
index 7ed1836..79a499b 100644
--- a/sc/source/ui/docshell/docsh.cxx
+++ b/sc/source/ui/docshell/docsh.cxx
@@ -320,7 +320,7 @@ void ScDocShell::AfterXMLLoading(bool bRet)
                             {
                                 sal_Int32 nIndex = nNameLength - nLinkTabNameLength;
                                 INetURLObject aINetURLObject(aDocURLBuffer.makeStringAndClear());
-                                if(aName == aLinkTabName.copy(nIndex, nLinkTabNameLength) &&
+                                if(aName.match( aLinkTabName, nIndex) &&
                                     (aName[nIndex - 1] == '#') && // before the table name should be the # char
                                     !aINetURLObject.HasError()) // the docname should be a valid URL
                                 {