[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - svl/source

[Eike Rathke]

 svl/source/numbers/zformat.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 5f2a69740af96f36d32093026059b9d0d2ea6fb0
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Jul 10 23:46:30 2015 +0200

    fix string access out of bounds
    
    Could happen with a malformed subformat string like "[<0-0".
    
    Change-Id: I8eaab2bcb469d91432a41dc349060c273a6575a4
    (cherry picked from commit f52aa4d13b7f262a4c54f4e554f45d64a545bce7)
    Reviewed-on: https://gerrit.libreoffice.org/16939
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 5a7d557..91bba556 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -697,7 +697,7 @@ SvNumberformat::SvNumberformat(OUString& rString,
                     {
                         fLimit2 = fNumber;
                     }
-                    if ( sBuff[nPos] == ']' )
+                    if ( nPos < sBuff.getLength() && sBuff[nPos] == ']' )
                     {
                         nPos++;
                     }