Blob Blame History Raw
From 88a2e6260c7e5eb9d96129c7391b9ed2ba8272ba Mon Sep 17 00:00:00 2001
Message-Id: <88a2e6260c7e5eb9d96129c7391b9ed2ba8272ba.1363951504.git.erack@redhat.com>
From: Eike Rathke <erack@redhat.com>
Date: Thu, 21 Mar 2013 16:34:56 +0100
Subject: [PATCH] fixed a possible crasher
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------------erAck-patch-parts"

This is a multi-part message in MIME format.
--------------erAck-patch-parts
Content-Type: text/plain; charset=UTF-8; format=fixed
Content-Transfer-Encoding: 8bit


Change-Id: I3b67ba1a8896b4b291e009b4ad680e1342ba9460
Reviewed-on: https://gerrit.libreoffice.org/2894
Reviewed-by: Petr Mladek <pmladek@suse.cz>
Tested-by: Petr Mladek <pmladek@suse.cz>
---
 basic/source/sbx/sbxscan.cxx | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)


--------------erAck-patch-parts
Content-Type: text/x-patch; name="0001-fixed-a-possible-crasher.patch"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="0001-fixed-a-possible-crasher.patch"

diff --git a/basic/source/sbx/sbxscan.cxx b/basic/source/sbx/sbxscan.cxx
index 80276a3..63f6dea 100644
--- a/basic/source/sbx/sbxscan.cxx
+++ b/basic/source/sbx/sbxscan.cxx
@@ -97,7 +97,7 @@ SbxError ImpScan( const ::rtl::OUString& rWSrc, double& nVal, SbxDataType& rType
 
     const char* pStart = aBStr.getStr();
     const char* p = pStart;
-    char buf[ 80 ], *q = buf;
+    rtl::OStringBuffer aBuf( rWSrc.getLength());
     sal_Bool bRes = sal_True;
     sal_Bool bMinus = sal_False;
     nVal = 0;
@@ -134,7 +134,7 @@ SbxError ImpScan( const ::rtl::OUString& rWSrc, double& nVal, SbxDataType& rType
                 if( ++comma > 1 )
                     continue;
                 else
-                    *q++ = '.';
+                    aBuf.append('.');
             }
             else if( strchr( "DdEe", *p ) )
             {
@@ -144,22 +144,21 @@ SbxError ImpScan( const ::rtl::OUString& rWSrc, double& nVal, SbxDataType& rType
                 }
                 if( toupper( *p ) == 'D' )
                     eScanType = SbxDOUBLE;
-                *q++ = 'E'; p++;
+                aBuf.append('E'); p++;
 
                 if( *p == '+' )
                     p++;
                 else
                 if( *p == '-' )
-                    *q++ = *p++;
+                    aBuf.append( *p++ );
             }
             else
             {
-                *q++ = *p++;
+                aBuf.append( *p++ );
                 if( comma && !exp ) ncdig++;
             }
             if( !exp ) ndig++;
         }
-        *q = 0;
 
         if( comma > 1 || exp > 1 )
             bRes = sal_False;
@@ -172,7 +171,7 @@ SbxError ImpScan( const ::rtl::OUString& rWSrc, double& nVal, SbxDataType& rType
                 eScanType = SbxLONG;
         }
 
-        nVal = atof( buf );
+        nVal = atof( aBuf.makeStringAndClear().getStr() );
         ndig = ndig - comma;
         // too many numbers for SINGLE?
         if( ndig > 15 || ncdig > 6 )
@@ -202,11 +201,11 @@ SbxError ImpScan( const ::rtl::OUString& rWSrc, double& nVal, SbxDataType& rType
         {
             char ch = sal::static_int_cast< char >( toupper( *p ) );
             p++;
-            if( strchr( cmp, ch ) ) *q++ = ch;
+            if( strchr( cmp, ch ) ) aBuf.append( ch );
             else bRes = sal_False;
         }
-        *q = 0;
-        for( q = buf; *q; q++ )
+        rtl::OString aBufStr( aBuf.makeStringAndClear());
+        for( const sal_Char* q = aBufStr.getStr(); *q; q++ )
         {
             i =( *q & 0xFF ) - '0';
             if( i > 9 ) i -= 7;

--------------erAck-patch-parts--