cui/source/tabpages/numfmt.cxx | 18 +++++++++++++++--- svl/source/numbers/zformat.cxx | 14 ++++++++++++-- 2 files changed, 27 insertions(+), 5 deletions(-)
New commits: commit 839cc63e7d1b78c56e04bafb46037e898ce2c455 Author: Eike Rathke <[email protected]> Date: Mon Aug 18 14:09:20 2014 +0200 prevent out-of-bounds string access ... while entering a * star symbol format code and there's no fill character following the * yet. Change-Id: I006f125ceefccba6a95ea033fd434d98e5d4f1c2 diff --git a/cui/source/tabpages/numfmt.cxx b/cui/source/tabpages/numfmt.cxx index c235cfa..1577c2a 100644 --- a/cui/source/tabpages/numfmt.cxx +++ b/cui/source/tabpages/numfmt.cxx @@ -113,9 +113,21 @@ void SvxNumberPreview::NotifyChange( const OUString& rPrevStr, mnPos = aPrevStr.indexOf( 0x1B ); if ( mnPos != -1 ) { - mnChar = aPrevStr[ mnPos + 1 ]; - // delete placeholder and char to repeat - aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" ); + // Right during user input the star symbol is the very + // last character before the user enters another one. + if (mnPos < aPrevStr.getLength() - 1) + { + mnChar = aPrevStr[ mnPos + 1 ]; + // delete placeholder and char to repeat + aPrevStr = aPrevStr.replaceAt( mnPos, 2, "" ); + } + else + { + // delete placeholder + aPrevStr = aPrevStr.replaceAt( mnPos, 1, "" ); + // do not attempt to draw a 0 fill character + mnPos = -1; + } } svtools::ColorConfig aColorConfig; Color aWindowTextColor( aColorConfig.GetColorValue( svtools::FONTCOLOR ).nColor ); diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx index 5815cac..69e0059 100644 --- a/svl/source/numbers/zformat.cxx +++ b/svl/source/numbers/zformat.cxx @@ -2590,8 +2590,18 @@ bool SvNumberformat::GetOutputString(double fNumber, if( bStarFlag ) { sBuff.append((sal_Unicode) 0x1B); - sBuff.append(rInfo.sStrArray[i][1]); - bRes = true; + const OUString& rStr =rInfo.sStrArray[i]; + // Right during user input the star symbol is the very + // last character before the user enters another one. + if (rStr.getLength() > 1) + { + sBuff.append(rStr[1]); + bRes = true; + } + else + { + bRes = false; + } } break; case NF_SYMBOLTYPE_BLANK: _______________________________________________ Libreoffice-commits mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
