starmath/source/parse.cxx | 4 +++-
sw/qa/core/data/ooxml/pass/fdo79973.docx |binary
2 files changed, 3 insertions(+), 1 deletion(-)
New commits:
commit 077121eb0debc1c78cf46038e2b90a0c2f381c44
Author: PriyankaGaikwad <priyanka.gaik...@synerzip.com>
Date: Fri Jun 20 18:53:29 2014 +0530
fdo#79973 : LO crashes while opening the document.
Description:
- If the equation ends with two dots(.) then file get crash.
- In SmParser::NextToken()
the file get crash because string index is out of bound.
Change-Id: I5f25814220d556d53c10d4ca33a38b4d0d451438
Reviewed-on: https://gerrit.libreoffice.org/9840
Reviewed-by: Muthu Subramanian K <muthus...@gmail.com>
Tested-by: Muthu Subramanian K <muthus...@gmail.com>
diff --git a/starmath/source/parse.cxx b/starmath/source/parse.cxx
index c78a040..b7373f1 100644
--- a/starmath/source/parse.cxx
+++ b/starmath/source/parse.cxx
@@ -884,11 +884,13 @@ void SmParser::NextToken()
sal_Int32 nTxtStart = m_nBufferIndex;
sal_Unicode cChar;
+ // if the equation ends with dot(.) then increment
m_nBufferIndex till end of string only
do
{
cChar = m_aBufferString[ ++m_nBufferIndex ];
}
- while ( cChar == '.' || rtl::isAsciiDigit( cChar )
);
+ while ( (cChar == '.' || rtl::isAsciiDigit( cChar
)) &&
+ ( m_nBufferIndex <
m_aBufferString.getLength() - 1 ) );
m_aCurToken.aText = m_aBufferString.copy(
nTxtStart, m_nBufferIndex - nTxtStart );
aRes.EndPos = m_nBufferIndex;
diff --git a/sw/qa/core/data/ooxml/pass/fdo79973.docx
b/sw/qa/core/data/ooxml/pass/fdo79973.docx
new file mode 100644
index 0000000..48bf510
Binary files /dev/null and b/sw/qa/core/data/ooxml/pass/fdo79973.docx differ
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
