[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - svl/source

[Eike Rathke]

 svl/source/numbers/zforscan.cxx |   23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

New commits:
commit 73d241d9b876bf464176878d76ae6f6497341a13
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Mar 10 13:48:24 2017 +0100

    prevent string access out of bounds
    
    Though only the closing 0-character and the following check excludes that,
    dbgutil asserts.
    
    (cherry picked from commit c407fff205a270e02fe07885805b7250e71c28f8)
    
    Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7
    Reviewed-on: https://gerrit.libreoffice.org/35044
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 228afe76d628..9bc8326656df 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -836,18 +836,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr,
                 switch (cToken)
                 {
                 case '/': // AM/PM, A/P
-                    cNext = rStr[nPos];
-                    if ( cNext == 'P' || cNext == 'p' )
+                    if (nPos < rStr.getLength())
                     {
-                        sal_Int32 nLen = sSymbol.getLength();
-                        if ( 1 <= nLen &&
-                             (sSymbol[0] == 'A' || sSymbol[0] == 'a') &&
-                             (nLen == 1 ||
-                              (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm')
-                               && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm'))))
+                        cNext = rStr[nPos];
+                        if ( cNext == 'P' || cNext == 'p' )
                         {
-                            sSymbol += OUString(cToken);
-                            bDontStop = true;
+                            sal_Int32 nLen = sSymbol.getLength();
+                            if ( 1 <= nLen &&
+                                    (sSymbol[0] == 'A' || sSymbol[0] == 'a') &&
+                                    (nLen == 1 ||
+                                     (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm')
+                                      && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm'))))
+                            {
+                                sSymbol += OUString(cToken);
+                                bDontStop = true;
+                            }
                         }
                     }
                     break;