diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-12-10 21:20:03 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2015-12-10 21:31:16 +0000 |
commit | 1e0b9881b4dc7d002d5da767f1476fb1c2147fc7 (patch) | |
tree | fd5b8419aa42d9df5317a46950a87474918eb85f /lotuswordpro | |
parent | 6834384e80cf5cd374cdec471ce385ba2ca94580 (diff) |
guard against broken formula and bad lengths
Change-Id: Iab13d67fdc218c84400a4d84e177e5096bb68379
Diffstat (limited to 'lotuswordpro')
-rw-r--r-- | lotuswordpro/source/filter/lwptblformula.cxx | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwptblformula.cxx b/lotuswordpro/source/filter/lwptblformula.cxx index 0562eea68bc2..963377e8a799 100644 --- a/lotuswordpro/source/filter/lwptblformula.cxx +++ b/lotuswordpro/source/filter/lwptblformula.cxx @@ -170,8 +170,13 @@ bool LwpFormulaInfo::ReadExpression() /* Read the compiled expression length */ m_pObjStrm->SeekRel(2); - while ((TokenType = m_pObjStrm->QuickReaduInt16()) != TK_END) + bool bError = false; + while ((TokenType = m_pObjStrm->QuickReaduInt16(&bError)) != TK_END) { + + if (bError) + throw std::runtime_error("error reading expression"); + // Get the disk length of this token DiskLength = m_pObjStrm->QuickReaduInt16(); @@ -221,19 +226,29 @@ bool LwpFormulaInfo::ReadExpression() case TK_NOT: m_pObjStrm->SeekRel(DiskLength); // extensible for future + if (m_aStack.size() >= 2) {//binary operator LwpFormulaOp* pOp = new LwpFormulaOp(TokenType); pOp->AddArg(m_aStack.back()); m_aStack.pop_back(); pOp->AddArg(m_aStack.back()); m_aStack.pop_back(); m_aStack.push_back(pOp); } + else + { + readSucceeded = false; + } break; case TK_UNARY_MINUS: + if (!m_aStack.empty()) { LwpFormulaUnaryOp* pOp = new LwpFormulaUnaryOp(TokenType); pOp->AddArg(m_aStack.back()); m_aStack.pop_back(); m_aStack.push_back(pOp); } + else + { + readSucceeded = false; + } break; default: // We don't know what to do with this token, so eat it. |