summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-12-10 21:20:03 +0000
committerCaolán McNamara <caolanm@redhat.com>2015-12-10 21:32:37 +0000
commitcf0d1237452ce327f046b33db9871fcf1e65c826 (patch)
tree7e80cf5b2df51defeab7f10b1a1785fac3002baa
parent32af2d9eb634aad4820b9406c89357099d01aaf8 (diff)
guard against broken formula and bad lengths
Change-Id: Iab13d67fdc218c84400a4d84e177e5096bb68379 (cherry picked from commit 1e0b9881b4dc7d002d5da767f1476fb1c2147fc7)
-rw-r--r--lotuswordpro/source/filter/lwptblformula.cxx17
1 files changed, 16 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwptblformula.cxx b/lotuswordpro/source/filter/lwptblformula.cxx
index 0562eea68bc2..963377e8a799 100644
--- a/lotuswordpro/source/filter/lwptblformula.cxx
+++ b/lotuswordpro/source/filter/lwptblformula.cxx
@@ -170,8 +170,13 @@ bool LwpFormulaInfo::ReadExpression()
/* Read the compiled expression length */
m_pObjStrm->SeekRel(2);
- while ((TokenType = m_pObjStrm->QuickReaduInt16()) != TK_END)
+ bool bError = false;
+ while ((TokenType = m_pObjStrm->QuickReaduInt16(&bError)) != TK_END)
{
+
+ if (bError)
+ throw std::runtime_error("error reading expression");
+
// Get the disk length of this token
DiskLength = m_pObjStrm->QuickReaduInt16();
@@ -221,19 +226,29 @@ bool LwpFormulaInfo::ReadExpression()
case TK_NOT:
m_pObjStrm->SeekRel(DiskLength); // extensible for future
+ if (m_aStack.size() >= 2)
{//binary operator
LwpFormulaOp* pOp = new LwpFormulaOp(TokenType);
pOp->AddArg(m_aStack.back()); m_aStack.pop_back();
pOp->AddArg(m_aStack.back()); m_aStack.pop_back();
m_aStack.push_back(pOp);
}
+ else
+ {
+ readSucceeded = false;
+ }
break;
case TK_UNARY_MINUS:
+ if (!m_aStack.empty())
{
LwpFormulaUnaryOp* pOp = new LwpFormulaUnaryOp(TokenType);
pOp->AddArg(m_aStack.back()); m_aStack.pop_back();
m_aStack.push_back(pOp);
}
+ else
+ {
+ readSucceeded = false;
+ }
break;
default:
// We don't know what to do with this token, so eat it.