diff options
author | Miklos Vajna <vmiklos@suse.cz> | 2012-07-27 17:26:12 +0200 |
---|---|---|
committer | Miklos Vajna <vmiklos@suse.cz> | 2012-07-27 17:28:09 +0200 |
commit | 55d72ab8ec4e4445e62f8224b5f54e97c464c4a5 (patch) | |
tree | fec6dc8d79b1160199c034fbb2bbde22930411d1 | |
parent | SmOoxmlImport::handleR: escape brackets in math runs (diff) | |
download | core-55d72ab8ec4e4445e62f8224b5f54e97c464c4a5.tar.gz core-55d72ab8ec4e4445e62f8224b5f54e97c464c4a5.zip |
RTFDocumentImpl::text: don't try to read beyond the end of string
Change-Id: If8dc4686f28870f1ce6b22458e29d3a9043f9783
-rw-r--r-- | writerfilter/source/rtftok/rtfdocumentimpl.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx index 6729b8880e39..b63bc3c90724 100644 --- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx +++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx @@ -984,7 +984,7 @@ void RTFDocumentImpl::text(OUString& rString) m_aStates.top().aDestinationText.append(rString); break; case DESTINATION_EQINSTRUCTION: - if ( rString.copy(0, 2) == "do" && rString.copy(2).toInt32() > 0 ) + if ( rString.getLength() > 3 && rString.copy(0, 2) == "do" && rString.copy(2).toInt32() > 0 ) dispatchFlag(RTF_SUB); break; default: bRet = false; break; |