[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - svl/source

[Caolán McNamara]

 svl/source/numbers/zforscan.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit b7c3579484c842c6de2aa46453926d2e30a1d120
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 6 09:20:53 2015 +0100

    a malformed string here can force an out of bounds indexOf
    
    Change-Id: Ic4d922bd27b7f119a7f8b95bbb4d4ed9e89fe51d
    (cherry picked from commit 592ee0308a36518137ab8ed965f28de4600909da)
    Reviewed-on: https://gerrit.libreoffice.org/16787
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>

diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index ba94239..b539782 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -889,7 +889,7 @@ sal_Int32 ImpSvNumberformatScan::Symbol_Division(const OUString& rString)
     // Do we have some sort of currency?
     OUString sString = pFormatter->GetCharClass()->uppercase(rString);
     sal_Int32 nCPos = 0;
-    while (nCPos >= 0)
+    while (nCPos >= 0 && nCPos < sString.getLength())
     {
         nCPos = sString.indexOf(GetCurString(),nCPos);
         if (nCPos >= 0)