diff options
author | Eike Rathke <erack@redhat.com> | 2014-08-18 14:09:20 +0200 |
---|---|---|
committer | Eike Rathke <erack@redhat.com> | 2014-08-18 14:50:16 +0200 |
commit | 839cc63e7d1b78c56e04bafb46037e898ce2c455 (patch) | |
tree | 1454db2a1dc9ed938f1aa86a395cedc322bb41f6 /cui/source | |
parent | Generally better to have DLLPUBLIC class with some DLLPRIVATE members (diff) | |
download | core-839cc63e7d1b78c56e04bafb46037e898ce2c455.tar.gz core-839cc63e7d1b78c56e04bafb46037e898ce2c455.zip |
prevent out-of-bounds string access
... while entering a * star symbol format code and there's no fill
character following the * yet.
Change-Id: I006f125ceefccba6a95ea033fd434d98e5d4f1c2
Diffstat (limited to 'cui/source')
-rw-r--r-- | cui/source/tabpages/numfmt.cxx | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/cui/source/tabpages/numfmt.cxx b/cui/source/tabpages/numfmt.cxx index c235cfa5a5bc..1577c2a8c1e8 100644 --- a/cui/source/tabpages/numfmt.cxx +++ b/cui/source/tabpages/numfmt.cxx @@ -113,9 +113,21 @@ void SvxNumberPreview::NotifyChange( const OUString& rPrevStr, mnPos = aPrevStr.indexOf( 0x1B ); if ( mnPos != -1 ) { - mnChar = aPrevStr[ mnPos + 1 ]; - // delete placeholder and char to repeat - aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" ); + // Right during user input the star symbol is the very + // last character before the user enters another one. + if (mnPos < aPrevStr.getLength() - 1) + { + mnChar = aPrevStr[ mnPos + 1 ]; + // delete placeholder and char to repeat + aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" ); + } + else + { + // delete placeholder + aPrevStr = aPrevStr.replaceAt( mnPos, 1, "" ); + // do not attempt to draw a 0 fill character + mnPos = -1; + } } svtools::ColorConfig aColorConfig; Color aWindowTextColor( aColorConfig.GetColorValue( svtools::FONTCOLOR ).nColor ); |