diff options
| author | Eike Rathke <erack@redhat.com> | 2016-05-31 00:02:38 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2016-05-31 00:10:00 +0200 |
| commit | c75ce37560c05271ba56c9dd0d98c5001e83cc2f (patch) | |
| tree | e681158383b9a5b73b44191fd117189c066cba47 /svl | |
| parent | d7834317c7c925e9096b464c5f5f3e7f76e3fda3 (diff) | |
prevent out of bounds string access
Yet another reminiscence of String to OUString conversion..
where the terminating NULL-character was obtained and
SvNumberformat::InsertBlanks() effectively did nothing.
Could be triggered already by entering an '_' underscore character as
number format code, which is a place holder for blanks of the same width
as the following character, which there isn't then yet.
Change-Id: I0534e1417d4bd35e9e7ed4bd0170b9ea3b5fb575
Diffstat (limited to 'svl')
| -rw-r--r-- | svl/source/numbers/zformat.cxx | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx index 2f2d412ad114..172f80219057 100644 --- a/svl/source/numbers/zformat.cxx +++ b/svl/source/numbers/zformat.cxx @@ -1926,8 +1926,8 @@ void SvNumberformat::GetOutputString(const OUString& sString, } break; case NF_SYMBOLTYPE_BLANK: - InsertBlanks( sOutBuff, sOutBuff.getLength(), - rInfo.sStrArray[i][1] ); + if (rInfo.sStrArray[i].getLength() >= 2) + InsertBlanks( sOutBuff, sOutBuff.getLength(), rInfo.sStrArray[i][1] ); break; case NF_KEY_GENERAL : // #77026# "General" is the same as "@" case NF_SYMBOLTYPE_DEL : @@ -2267,8 +2267,8 @@ bool SvNumberformat::GetOutputString(double fNumber, } break; case NF_SYMBOLTYPE_BLANK: - InsertBlanks(sBuff, sBuff.getLength(), - rInfo.sStrArray[i][1] ); + if (rInfo.sStrArray[i].getLength() >= 2) + InsertBlanks(sBuff, sBuff.getLength(), rInfo.sStrArray[i][1] ); break; case NF_SYMBOLTYPE_STRING: case NF_SYMBOLTYPE_CURRENCY: @@ -2899,8 +2899,8 @@ bool SvNumberformat::ImpGetTimeOutput(double fNumber, } break; case NF_SYMBOLTYPE_BLANK: - InsertBlanks(sBuff, sBuff.getLength(), - rInfo.sStrArray[i][1] ); + if (rInfo.sStrArray[i].getLength() >= 2) + InsertBlanks(sBuff, sBuff.getLength(), rInfo.sStrArray[i][1] ); break; case NF_SYMBOLTYPE_STRING: case NF_SYMBOLTYPE_CURRENCY: @@ -3395,7 +3395,8 @@ bool SvNumberformat::ImpGetDateOutput(double fNumber, } break; case NF_SYMBOLTYPE_BLANK: - InsertBlanks( sBuff, sBuff.getLength(), rInfo.sStrArray[i][1] ); + if (rInfo.sStrArray[i].getLength() >= 2) + InsertBlanks( sBuff, sBuff.getLength(), rInfo.sStrArray[i][1] ); break; case NF_SYMBOLTYPE_STRING: case NF_SYMBOLTYPE_CURRENCY: @@ -3688,8 +3689,8 @@ bool SvNumberformat::ImpGetDateTimeOutput(double fNumber, } break; case NF_SYMBOLTYPE_BLANK: - InsertBlanks( sBuff, sBuff.getLength(), - rInfo.sStrArray[i][1] ); + if (rInfo.sStrArray[i].getLength() >= 2) + InsertBlanks( sBuff, sBuff.getLength(), rInfo.sStrArray[i][1] ); break; case NF_SYMBOLTYPE_STRING: case NF_SYMBOLTYPE_CURRENCY: @@ -4335,7 +4336,8 @@ bool SvNumberformat::ImpNumberFill( OUStringBuffer& sBuff, // number string } break; case NF_SYMBOLTYPE_BLANK: - k = InsertBlanks(sBuff, k, rInfo.sStrArray[j][1] ); + if (rInfo.sStrArray[j].getLength() >= 2) + k = InsertBlanks(sBuff, k, rInfo.sStrArray[j][1] ); break; case NF_SYMBOLTYPE_THSEP: // Same as in ImpNumberFillWithThousands() above, do not insert |