[PATCH libreoffice-3-6-6] fixed a possible crasher

[Eike Rathke (via Code Review)]

Hi,

I have submitted a patch for review:

    https://gerrit.libreoffice.org/2895

To pull it, you can do:

    git pull ssh://gerrit.libreoffice.org:29418/core refs/changes/95/2895/1

fixed a possible crasher

Change-Id: I3b67ba1a8896b4b291e009b4ad680e1342ba9460
---
M basic/source/sbx/sbxscan.cxx
1 file changed, 9 insertions(+), 10 deletions(-)



diff --git a/basic/source/sbx/sbxscan.cxx b/basic/source/sbx/sbxscan.cxx
index 80276a3..63f6dea 100644
--- a/basic/source/sbx/sbxscan.cxx
+++ b/basic/source/sbx/sbxscan.cxx
@@ -97,7 +97,7 @@
 
     const char* pStart = aBStr.getStr();
     const char* p = pStart;
-    char buf[ 80 ], *q = buf;
+    rtl::OStringBuffer aBuf( rWSrc.getLength());
     sal_Bool bRes = sal_True;
     sal_Bool bMinus = sal_False;
     nVal = 0;
@@ -134,7 +134,7 @@
                 if( ++comma > 1 )
                     continue;
                 else
-                    *q++ = '.';
+                    aBuf.append('.');
             }
             else if( strchr( "DdEe", *p ) )
             {
@@ -144,22 +144,21 @@
                 }
                 if( toupper( *p ) == 'D' )
                     eScanType = SbxDOUBLE;
-                *q++ = 'E'; p++;
+                aBuf.append('E'); p++;
 
                 if( *p == '+' )
                     p++;
                 else
                 if( *p == '-' )
-                    *q++ = *p++;
+                    aBuf.append( *p++ );
             }
             else
             {
-                *q++ = *p++;
+                aBuf.append( *p++ );
                 if( comma && !exp ) ncdig++;
             }
             if( !exp ) ndig++;
         }
-        *q = 0;
 
         if( comma > 1 || exp > 1 )
             bRes = sal_False;
@@ -172,7 +171,7 @@
                 eScanType = SbxLONG;
         }
 
-        nVal = atof( buf );
+        nVal = atof( aBuf.makeStringAndClear().getStr() );
         ndig = ndig - comma;
         // too many numbers for SINGLE?
         if( ndig > 15 || ncdig > 6 )
@@ -202,11 +201,11 @@
         {
             char ch = sal::static_int_cast< char >( toupper( *p ) );
             p++;
-            if( strchr( cmp, ch ) ) *q++ = ch;
+            if( strchr( cmp, ch ) ) aBuf.append( ch );
             else bRes = sal_False;
         }
-        *q = 0;
-        for( q = buf; *q; q++ )
+        rtl::OString aBufStr( aBuf.makeStringAndClear());
+        for( const sal_Char* q = aBufStr.getStr(); *q; q++ )
         {
             i =( *q & 0xFF ) - '0';
             if( i > 9 ) i -= 7;

-- 
To view, visit https://gerrit.libreoffice.org/2895
To unsubscribe, visit https://gerrit.libreoffice.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I3b67ba1a8896b4b291e009b4ad680e1342ba9460
Gerrit-PatchSet: 1
Gerrit-Project: core
Gerrit-Branch: libreoffice-3-6-6
Gerrit-Owner: Eike Rathke <erack at redhat.com>