diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2021-01-04 17:19:47 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2021-01-05 15:10:53 +0100 |
| commit | 52de00024e84c063ab292890256cda59fe259ef5 (patch) | |
| tree | 306dd9d5aa26bdb2c409dbb2cf43c9b1a98e9317 | |
| parent | 9165d5f834a6c831e8683a430bf5911eb4316b68 (diff) | |
ofz#29234 Integer-overflow
sc/source/core/tool/interpr1.cxx:9578:39: runtime error: signed integer overflow: 1 + 2147483647 cannot be represented in type 'int'
Change-Id: I2975ae1daab826f10f0e52e7d7421ac8dcc9fffc
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/108677
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | sc/source/core/tool/interpr1.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx index b55f1172f704..b9050787dfd9 100644 --- a/sc/source/core/tool/interpr1.cxx +++ b/sc/source/core/tool/interpr1.cxx @@ -9563,6 +9563,8 @@ void ScInterpreter::ScMid() OUString aStr = GetString().getString(); if ( nStart < 1 || nSubLen < 0 ) PushIllegalArgument(); + else if (nStart > kScInterpreterMaxStrLen || nSubLen > kScInterpreterMaxStrLen) + PushError(FormulaError::StringOverflow); else { sal_Int32 nLen = aStr.getLength(); |