diff options
author | Miklos Vajna <vmiklos@suse.cz> | 2013-04-03 17:36:26 +0200 |
---|---|---|
committer | Miklos Vajna <vmiklos@suse.cz> | 2013-04-03 17:38:00 +0200 |
commit | 008275d56f9ac5248f0e94f606671b4c1993ca20 (patch) | |
tree | 1136f9912c7e090678619dff1166fed08efc33d5 | |
parent | fdo#51916 testcase (diff) | |
download | core-008275d56f9ac5248f0e94f606671b4c1993ca20.tar.gz core-008275d56f9ac5248f0e94f606671b4c1993ca20.zip |
fdo#51916 out of bounds substring access
Change-Id: I7db46ef17b8aed443faa7eb0c13b6ba109242cc1
-rw-r--r-- | writerfilter/source/rtftok/rtfdocumentimpl.cxx | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx index 0714b1579a68..d10a5a0b7951 100644 --- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx +++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx @@ -3940,11 +3940,14 @@ int RTFDocumentImpl::popState() // extract default text nLength = aStr.toChar(); aStr = aStr.copy(1); - OString aDefaultText = aStr.copy(0, nLength); RTFValue::Pointer_t pNValue(new RTFValue(OStringToOUString(aName, aState.nCurrentEncoding))); m_aFormfieldSprms.set(NS_ooxml::LN_CT_FFData_name, pNValue); - RTFValue::Pointer_t pDValue(new RTFValue(OStringToOUString(aDefaultText, aState.nCurrentEncoding))); - m_aFormfieldSprms.set(NS_ooxml::LN_CT_FFTextInput_default, pDValue); + if (nLength > 0) + { + OString aDefaultText = aStr.copy(0, nLength); + RTFValue::Pointer_t pDValue(new RTFValue(OStringToOUString(aDefaultText, aState.nCurrentEncoding))); + m_aFormfieldSprms.set(NS_ooxml::LN_CT_FFTextInput_default, pDValue); + } m_bFormField = false; } |