[Libreoffice-commits] core.git: starmath/source sw/qa

[PriyankaGaikwad]

 starmath/source/parse.cxx                |    4 +++-
 sw/qa/core/data/ooxml/pass/fdo79973.docx |binary
 2 files changed, 3 insertions(+), 1 deletion(-)

New commits:
commit 077121eb0debc1c78cf46038e2b90a0c2f381c44
Author: PriyankaGaikwad <priyanka.gaikwad at synerzip.com>
Date:   Fri Jun 20 18:53:29 2014 +0530

    fdo#79973 : LO crashes while opening the document.
    
    Description:
    - If the equation ends with two dots(.) then file get crash.
    - In SmParser::NextToken()
      the file get crash because string index is out of bound.
    
    Change-Id: I5f25814220d556d53c10d4ca33a38b4d0d451438
    Reviewed-on: https://gerrit.libreoffice.org/9840
    Reviewed-by: Muthu Subramanian K <muthusuba at gmail.com>
    Tested-by: Muthu Subramanian K <muthusuba at gmail.com>

diff --git a/starmath/source/parse.cxx b/starmath/source/parse.cxx
index c78a040..b7373f1 100644
--- a/starmath/source/parse.cxx
+++ b/starmath/source/parse.cxx
@@ -884,11 +884,13 @@ void SmParser::NextToken()
 
                             sal_Int32 nTxtStart = m_nBufferIndex;
                             sal_Unicode cChar;
+                            // if the equation ends with dot(.) then increment m_nBufferIndex till end of string only
                             do
                             {
                                 cChar = m_aBufferString[ ++m_nBufferIndex ];
                             }
-                            while ( cChar == '.' || rtl::isAsciiDigit( cChar ) );
+                            while ( (cChar == '.' || rtl::isAsciiDigit( cChar )) &&
+                                     ( m_nBufferIndex < m_aBufferString.getLength() - 1 ) );
 
                             m_aCurToken.aText = m_aBufferString.copy( nTxtStart, m_nBufferIndex - nTxtStart );
                             aRes.EndPos = m_nBufferIndex;
diff --git a/sw/qa/core/data/ooxml/pass/fdo79973.docx b/sw/qa/core/data/ooxml/pass/fdo79973.docx
new file mode 100644
index 0000000..48bf510
Binary files /dev/null and b/sw/qa/core/data/ooxml/pass/fdo79973.docx differ