[Libreoffice-commits] core.git: Branch 'libreoffice-5-1' - basic/source

[Julien Nabet]

 basic/source/runtime/methods.cxx |    2 +-
 basic/source/sbx/sbxscan.cxx     |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 0e19e4e17f5761d071768a11e16eb9d82d792cf4
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Sun Apr 10 09:41:56 2016 +0200

    tdf#99089: avoid some crashes in Basic
    
    First stacktrace:
    soffice.bin: /home/julien/compile-libreoffice/libreoffice/include/rtl/ustring.hxx:577:
    sal_Unicode rtl::OUString::operator[](sal_Int32) const:
    Assertion `index >= 0 && static_cast<sal_uInt32>(index) < static_cast<sal_uInt32>(getLength())' failed.
    ...
    3 0x00002aaaab327452 in __GI___assert_fail (assertion=0x2aaaaeea62a8 "index >= 0 && static_cast<sal_uInt32>(index) < static_cast<sal_uInt32>(getLength())...
    4 0x00002aaaaed91e89 in rtl::OUString::operator[](int) const (this=0x7fffffff2770, index=0) at /home/julien/compile-libreoffice/libreoffice/include/rtl/ustring.hxx:577
    5 0x00002aaaaee1c66f in SbRtl_Val(StarBASIC*, SbxArray&, bool) (pBasic=0xa2a7ec0, rPar=..., bWrite=false)
    at /home/julien/compile-libreoffice/libreoffice/basic/source/runtime/methods.cxx:1792
    
    Second stacktrace:
    0x00002aaaaee6054d in printfmtstr (rStr="", rRes="", rFmt="\£0.##") at /home/julien/compile-libreoffice/libreoffice/basic/source/sbx/sbxscan.cxx:534
    534 while( *pFmt != '\' );
    (gdb) bt
    0 0x00002aaaaee6054d in printfmtstr(rtl::OUString const&, rtl::OUString&, rtl::OUString const&) (rStr="", rRes="", rFmt="\£0.##")
    at /home/julien/compile-libreoffice/libreoffice/basic/source/sbx/sbxscan.cxx:534
    1 0x00002aaaaee617ce in SbxValue::Format(rtl::OUString&, rtl::OUString const*) const (this=0xb12dd60, rRes="", pFmt=0x7fffffff20e0)
    at /home/julien/compile-libreoffice/libreoffice/basic/source/sbx/sbxscan.cxx:883
    
    Reviewed-on: https://gerrit.libreoffice.org/23956
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Julien Nabet <serval2412 at yahoo.fr>
    (cherry picked from commit 43109b751bf5fd36318de56b2fb686acc724673f)
    
    Change-Id: I1798a1545ce08efa9d6fc39f4696195f9dc96c67
    Reviewed-on: https://gerrit.libreoffice.org/23957
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/basic/source/runtime/methods.cxx b/basic/source/runtime/methods.cxx
index aad8410..c28ddd2 100644
--- a/basic/source/runtime/methods.cxx
+++ b/basic/source/runtime/methods.cxx
@@ -1777,7 +1777,7 @@ RTLFUNC(Val)
         OUString aStr( rPar.Get(1)->GetOUString() );
 
         FilterWhiteSpace( aStr );
-        if ( aStr[0] == '&' && aStr.getLength() > 1 )
+        if ( aStr.getLength() > 1 && aStr[0] == '&' )
         {
             int nRadix = 10;
             char aChar = (char)aStr[1];
diff --git a/basic/source/sbx/sbxscan.cxx b/basic/source/sbx/sbxscan.cxx
index bc3d2ca..2d4a629 100644
--- a/basic/source/sbx/sbxscan.cxx
+++ b/basic/source/sbx/sbxscan.cxx
@@ -515,7 +515,7 @@ static sal_uInt16 printfmtstr( const OUString& rStr, OUString& rRes, const OUStr
             aTemp.append( *pStr ? *pStr++ : static_cast< sal_Unicode >(' '));
             pFmt++;
         }
-        while( *pFmt != '\\' );
+        while( *pFmt && *pFmt != '\\' );
         aTemp.append(*pStr ? *pStr++ : static_cast< sal_Unicode >(' '));
         pFmt++; break;
     case '&':