Hi,
I have submitted a patch for review:
https://gerrit.libreoffice.org/2007
To pull it, you can do:
git pull ssh://gerrit.libreoffice.org:29418/core refs/changes/07/2007/1
fdo#39135: Prevent integer overflow & update the character during loop.
These two errors in the code contributed to the reported bug. Let's
fix them.
Change-Id: If82a1bd4d1e27145b48e722b30388cc9dc4a8a6e
---
M sc/source/core/tool/reffind.cxx
1 file changed, 5 insertions(+), 0 deletions(-)
diff --git a/sc/source/core/tool/reffind.cxx b/sc/source/core/tool/reffind.cxx
index 2fe76fc..c4621f0 100644
--- a/sc/source/core/tool/reffind.cxx
+++ b/sc/source/core/tool/reffind.cxx
@@ -155,15 +155,20 @@
if (c == '\'')
break;
}
+ if (rStartPos == 0)
+ break;
}
else if (c == ']')
{
// Skip until the opening braket.
for (--rStartPos; rStartPos > 0; --rStartPos)
{
+ c = p[rStartPos];
if (c == '[')
break;
}
+ if (rStartPos == 0)
+ break;
}
else if (!IsText(c))
{
--
To view, visit https://gerrit.libreoffice.org/2007
To unsubscribe, visit https://gerrit.libreoffice.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: If82a1bd4d1e27145b48e722b30388cc9dc4a8a6e
Gerrit-PatchSet: 1
Gerrit-Project: core
Gerrit-Branch: libreoffice-4-0
Gerrit-Owner: Kohei Yoshida <kohei.yosh...@gmail.com>
_______________________________________________
LibreOffice mailing list
LibreOffice@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice
