diff options
| author | Eike Rathke <erack@redhat.com> | 2017-07-04 15:22:23 +0200 |
|---|---|---|
| committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2017-07-05 08:21:04 +0200 |
| commit | 1d1bdfd94fc2963d0281ea4fd8d3a98e39f4ccf7 (patch) | |
| tree | 30a1b8e07465c37bb398738cc55f6f61c621eca6 | |
| parent | 747be68119f2c85f1cdf6151fac67cd8cb840b76 (diff) | |
Set error on more than max params (255) per function
Parameter count is size byte, so.. SUM(1,1,1,...) with 256 arguments resulted
in 0 (uint8 wrapping around).
(cherry picked from commit 209cc5c211260a6c20cc6fb5ac02fd5a88100314)
Change-Id: Ib9997ad0d0d13d4c5171f276148b6c5cad570d5b
Reviewed-on: https://gerrit.libreoffice.org/39506
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
| -rw-r--r-- | formula/source/core/api/FormulaCompiler.cxx | 8 | ||||
| -rw-r--r-- | include/formula/FormulaCompiler.hxx | 1 |
2 files changed, 7 insertions, 2 deletions
diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx index 07c39037585a..2a561d2182e3 100644 --- a/formula/source/core/api/FormulaCompiler.cxx +++ b/formula/source/core/api/FormulaCompiler.cxx @@ -1511,7 +1511,7 @@ void FormulaCompiler::Factor() } else SetError( FormulaError::PairExpected); - sal_uInt8 nSepCount = 0; + sal_uInt32 nSepCount = 0; const sal_uInt16 nSepPos = pArr->nIndex - 1; // separator position, if any if( !bNoParam ) { @@ -1521,6 +1521,8 @@ void FormulaCompiler::Factor() NextToken(); CheckSetForceArrayParameter( mpToken, nSepCount); nSepCount++; + if (nSepCount > FORMULA_MAXPARAMS) + SetError( FormulaError::CodeOverflow); eOp = Expression(); } } @@ -1617,7 +1619,7 @@ void FormulaCompiler::Factor() } else SetError( FormulaError::PairExpected); - sal_uInt8 nSepCount = 0; + sal_uInt32 nSepCount = 0; if( !bNoParam ) { nSepCount++; @@ -1626,6 +1628,8 @@ void FormulaCompiler::Factor() NextToken(); CheckSetForceArrayParameter( mpToken, nSepCount); nSepCount++; + if (nSepCount > FORMULA_MAXPARAMS) + SetError( FormulaError::CodeOverflow); eOp = Expression(); } } diff --git a/include/formula/FormulaCompiler.hxx b/include/formula/FormulaCompiler.hxx index 37da2ef8becc..5293c504b1dd 100644 --- a/include/formula/FormulaCompiler.hxx +++ b/include/formula/FormulaCompiler.hxx @@ -38,6 +38,7 @@ #define FORMULA_MAXJUMPCOUNT 32 /* maximum number of jumps (ocChoose) */ #define FORMULA_MAXTOKENS 8192 /* maximum number of tokens in formula */ +#define FORMULA_MAXPARAMS 255 /* maximum number of parameters per function (byte) */ namespace com { namespace sun { namespace star { |