Lotus WK: fix warnings

Signed-off-by: Petr Mladek <pmladek@suse.cz>

14 files changed, 553 insertions, 469 deletions

diff --git a/sc/source/filter/excel/fontbuff.cxx b/sc/source/filter/excel/fontbuff.cxx
index af2521dbbaa0..2f1f0b7f1224 100644
--- a/sc/source/filter/excel/fontbuff.cxx
+++ b/sc/source/filter/excel/fontbuff.cxx
@@ -47,8 +47,6 @@
 #include "patattr.hxx"
 #include "ftools.hxx"
 
-const sal_uInt16    LotusFontBuffer::nSize = 8;
-
 void LotusFontBuffer::Fill( const sal_uInt8 nIndex, SfxItemSet& rItemSet )
 {
     sal_uInt8   nIntIndex = nIndex & 0x07;
diff --git a/sc/source/filter/excel/tokstack.cxx b/sc/source/filter/excel/tokstack.cxx
index ca2cc825ea20..8d3e762fe707 100644
--- a/sc/source/filter/excel/tokstack.cxx
+++ b/sc/source/filter/excel/tokstack.cxx
@@ -119,7 +119,7 @@ TokenPool::TokenPool( void )
 
 TokenPool::~TokenPool()
 {
-    sal_uInt16  n;
+    sal_uInt16	n;
 
     delete[] pP_Id;
     delete[] pElement;
@@ -128,32 +128,20 @@ TokenPool::~TokenPool()
     delete[] pP_Dbl;
     delete[] pP_Err;
 
-    for( n = 0 ; n < nP_RefTr ; n++/*, pAktTr++*/ )
-    {
-        if( ppP_RefTr[ n ] )
-            delete ppP_RefTr[ n ];
-    }
+    for( n = 0 ; n < nP_RefTr ; n++ )
+        delete ppP_RefTr[ n ];
     delete[] ppP_RefTr;
 
-    for( n = 0 ; n < nP_Str ; n++/*, pAktStr++*/ )
-    {
-        if( ppP_Str[ n ] )
-            delete ppP_Str[ n ];
-    }
+    for( n = 0 ; n < nP_Str ; n++ )
+        delete ppP_Str[ n ];
     delete[] ppP_Str;
 
     for( n = 0 ; n < nP_Ext ; n++ )
-    {
-        if( ppP_Ext[ n ] )
-            delete ppP_Ext[ n ];
-    }
+        delete ppP_Ext[ n ];
     delete[] ppP_Ext;
 
     for( n = 0 ; n < nP_Nlf ; n++ )
-    {
-        if( ppP_Nlf[ n ] )
-            delete ppP_Nlf[ n ];
-    }
+        delete ppP_Nlf[ n ];
     delete[] ppP_Nlf;
 
     for( n = 0 ; n < nP_Matrix ; n++ )
@@ -167,12 +155,34 @@ TokenPool::~TokenPool()
 }
 
 
-void TokenPool::GrowString( void )
+/** Returns the new number of elements, or 0 if overflow. */
+static sal_uInt16 lcl_canGrow( sal_uInt16 nOld, sal_uInt16 nByMin = 1 )
 {
-    sal_uInt16      nP_StrNew = nP_Str * 2;
+    if (!nOld)
+        return nByMin ? nByMin : 1;
+    if (nOld == SAL_MAX_UINT16)
+        return 0;
+    sal_uInt32 nNew = ::std::max( static_cast<sal_uInt32>(nOld) * 2,
+            static_cast<sal_uInt32>(nOld) + nByMin);
+    if (nNew > SAL_MAX_UINT16)
+        nNew = SAL_MAX_UINT16;
+    if (nNew - nByMin < nOld)
+        nNew = 0;
+    return static_cast<sal_uInt16>(nNew);
+}
+
+
+bool TokenPool::GrowString( void )
+{
+    sal_uInt16 nP_StrNew = lcl_canGrow( nP_Str);
+    if (!nP_StrNew)
+        return false;
+
     sal_uInt16      nL;
 
-    String**    ppP_StrNew = new String *[ nP_StrNew ];
+	String**	ppP_StrNew = new (::std::nothrow) String *[ nP_StrNew ];
+    if (!ppP_StrNew)
+        return false;
 
     for( nL = 0 ; nL < nP_Str ; nL++ )
         ppP_StrNew[ nL ] = ppP_Str[ nL ];
@@ -183,14 +193,20 @@ void TokenPool::GrowString( void )
 
     delete[]    ppP_Str;
     ppP_Str = ppP_StrNew;
+    return true;
 }
 
 
-void TokenPool::GrowDouble( void )
+bool TokenPool::GrowDouble( void )
 {
-    sal_uInt16      nP_DblNew = nP_Dbl * 2;
+    sal_uInt16 nP_DblNew = lcl_canGrow( nP_Dbl);
+    if (!nP_DblNew)
+        return false;
+
 
-    double*     pP_DblNew = new double[ nP_DblNew ];
+	double*		pP_DblNew = new (::std::nothrow) double[ nP_DblNew ];
+    if (!pP_DblNew)
+        return false;
 
     for( sal_uInt16 nL = 0 ; nL < nP_Dbl ; nL++ )
         pP_DblNew[ nL ] = pP_Dbl[ nL ];
@@ -199,14 +215,46 @@ void TokenPool::GrowDouble( void )
 
     delete[] pP_Dbl;
     pP_Dbl = pP_DblNew;
+    return true;
+}
+
+
+/* TODO: in case we had FormulaTokenArray::AddError() */
+#if 0
+void TokenPool::GrowError( void )
+{
+    sal_uInt16 nP_ErrNew = lcl_canGrow( nP_Err);
+    if (!nP_ErrNew)
+        return false;
+
+
+    sal_uInt16*     pP_ErrNew = new (::std::nothrow) sal_uInt16[ nP_ErrNew ];
+    if (!pP_ErrNew)
+        return false;
+
+    for( sal_uInt16 nL = 0 ; nL < nP_Err ; nL++ )
+        pP_ErrNew[ nL ] = pP_Err[ nL ];
+
+    nP_Err = nP_ErrNew;
+
+    delete[] pP_Err;
+    pP_Err = pP_ErrNew;
+    return true;
 }
+#endif
 
-void TokenPool::GrowTripel( void )
+
+bool TokenPool::GrowTripel( sal_uInt16 nByMin )
 {
-    sal_uInt16          nP_RefTrNew = nP_RefTr * 2;
+    sal_uInt16 nP_RefTrNew = lcl_canGrow( nP_RefTr, nByMin);
+    if (!nP_RefTrNew)
+        return false;
+
     sal_uInt16          nL;
 
-    ScSingleRefData**   ppP_RefTrNew = new ScSingleRefData *[ nP_RefTrNew ];
+	ScSingleRefData**	ppP_RefTrNew = new (::std::nothrow) ScSingleRefData *[ nP_RefTrNew ];
+    if (!ppP_RefTrNew)
+        return false;
 
     for( nL = 0 ; nL < nP_RefTr ; nL++ )
         ppP_RefTrNew[ nL ] = ppP_RefTr[ nL ];
@@ -217,14 +265,20 @@ void TokenPool::GrowTripel( void )
 
     delete[] ppP_RefTr;
     ppP_RefTr = ppP_RefTrNew;
+    return true;
 }
 
 
-void TokenPool::GrowId( void )
+bool TokenPool::GrowId( void )
 {
-    sal_uInt16  nP_IdNew = nP_Id * 2;
+    sal_uInt16 nP_IdNew = lcl_canGrow( nP_Id);
+    if (!nP_IdNew)
+        return false;
 
-    sal_uInt16* pP_IdNew = new sal_uInt16[ nP_IdNew ];
+
+	sal_uInt16*	pP_IdNew = new (::std::nothrow) sal_uInt16[ nP_IdNew ];
+    if (!pP_IdNew)
+        return false;
 
     for( sal_uInt16 nL = 0 ; nL < nP_Id ; nL++ )
         pP_IdNew[ nL ] = pP_Id[ nL ];
@@ -233,16 +287,27 @@ void TokenPool::GrowId( void )
 
     delete[] pP_Id;
     pP_Id = pP_IdNew;
+    return true;
 }
 
 
-void TokenPool::GrowElement( void )
+bool TokenPool::GrowElement( void )
 {
-    sal_uInt16  nElementNew = nElement * 2;
+    sal_uInt16 nElementNew = lcl_canGrow( nElement);
+    if (!nElementNew)
+        return false;
+
 
-    sal_uInt16* pElementNew = new sal_uInt16[ nElementNew ];
-    E_TYPE* pTypeNew = new E_TYPE[ nElementNew ];
-    sal_uInt16* pSizeNew = new sal_uInt16[ nElementNew ];
+	sal_uInt16*	pElementNew = new (::std::nothrow) sal_uInt16[ nElementNew ];
+	E_TYPE*	pTypeNew = new (::std::nothrow) E_TYPE[ nElementNew ];
+	sal_uInt16*	pSizeNew = new (::std::nothrow) sal_uInt16[ nElementNew ];
+    if (!pElementNew || !pTypeNew || !pSizeNew)
+    {
+        delete [] pElementNew;
+        delete [] pTypeNew;
+        delete [] pSizeNew;
+        return false;
+    }
 
     for( sal_uInt16 nL = 0 ; nL < nElement ; nL++ )
     {
@@ -259,14 +324,19 @@ void TokenPool::GrowElement( void )
     pElement = pElementNew;
     pType = pTypeNew;
     pSize = pSizeNew;
+    return true;
 }
 
 
-void TokenPool::GrowExt( void )
+bool TokenPool::GrowExt( void )
 {
-    sal_uInt16      nNewSize = nP_Ext * 2;
+    sal_uInt16 nNewSize = lcl_canGrow( nP_Ext);
+    if (!nNewSize)
+        return false;
 
-    EXTCONT**   ppNew = new EXTCONT*[ nNewSize ];
+	EXTCONT**	ppNew = new (::std::nothrow) EXTCONT*[ nNewSize ];
+    if (!ppNew)
+        return false;
 
     memset( ppNew, 0, sizeof( EXTCONT* ) * nNewSize );
     memcpy( ppNew, ppP_Ext, sizeof( EXTCONT* ) * nP_Ext );
@@ -274,14 +344,19 @@ void TokenPool::GrowExt( void )
     delete[] ppP_Ext;
     ppP_Ext = ppNew;
     nP_Ext = nNewSize;
+    return true;
 }
 
 
-void TokenPool::GrowNlf( void )
+bool TokenPool::GrowNlf( void )
 {
-    sal_uInt16      nNewSize = nP_Nlf * 2;
+    sal_uInt16 nNewSize = lcl_canGrow( nP_Nlf);
+    if (!nNewSize)
+        return false;
 
-    NLFCONT**   ppNew = new NLFCONT*[ nNewSize ];
+	NLFCONT**	ppNew = new (::std::nothrow) NLFCONT*[ nNewSize ];
+    if (!ppNew)
+        return false;
 
     memset( ppNew, 0, sizeof( NLFCONT* ) * nNewSize );
     memcpy( ppNew, ppP_Nlf, sizeof( NLFCONT* ) * nP_Nlf );
@@ -289,14 +364,19 @@ void TokenPool::GrowNlf( void )
     delete[] ppP_Nlf;
     ppP_Nlf = ppNew;
     nP_Nlf = nNewSize;
+    return true;
 }
 
 
-void TokenPool::GrowMatrix( void )
+bool TokenPool::GrowMatrix( void )
 {
-    sal_uInt16      nNewSize = nP_Matrix * 2;
+    sal_uInt16 nNewSize = lcl_canGrow( nP_Matrix);
+    if (!nNewSize)
+        return false;
 
-    ScMatrix**  ppNew = new ScMatrix*[ nNewSize ];
+    ScMatrix**  ppNew = new (::std::nothrow) ScMatrix*[ nNewSize ];
+    if (!ppNew)
+        return false;
 
     memset( ppNew, 0, sizeof( ScMatrix* ) * nNewSize );
     memcpy( ppNew, ppP_Matrix, sizeof( ScMatrix* ) * nP_Matrix );
@@ -304,40 +384,75 @@ void TokenPool::GrowMatrix( void )
     delete[] ppP_Matrix;
     ppP_Matrix = ppNew;
     nP_Matrix = nNewSize;
+    return true;
 }
 
-void TokenPool::GetElement( const sal_uInt16 nId )
+bool TokenPool::GetElement( const sal_uInt16 nId )
 {
-    OSL_ENSURE( nId < nElementAkt, "*TokenPool::GetElement(): Id zu gross!?" );
+    OSL_ENSURE( nId < nElementAkt, "*TokenPool::GetElement(): Id too large!?" );
+    if (nId >= nElementAkt)
+        return false;
 
+    bool bRet = true;
     if( pType[ nId ] == T_Id )
-        GetElementRek( nId );
+        bRet = GetElementRek( nId );
     else
     {
         switch( pType[ nId ] )
         {
-#if OSL_DEBUG_LEVEL > 0
-            case T_Id:
-                OSL_FAIL( "-TokenPool::GetElement(): hier hast Du nichts zu suchen!" );
-                break;
-#endif
             case T_Str:
-                pScToken->AddString( ppP_Str[ pElement[ nId ] ]->GetBuffer() );
+                {
+                    sal_uInt16 n = pElement[ nId ];
+                    String* p = ( n < nP_Str )? ppP_Str[ n ] : NULL;
+                    if (p)
+                        pScToken->AddString( *p );
+                    else
+                        bRet = false;
+                }
                 break;
             case T_D:
-                pScToken->AddDouble( pP_Dbl[ pElement[ nId ] ] );
+                {
+                    sal_uInt16 n = pElement[ nId ];
+                    if (n < nP_Dbl)
+                        pScToken->AddDouble( pP_Dbl[ n ] );
+                    else
+                        bRet = false;
+                }
                 break;
             case T_Err:
+/* TODO: in case we had FormulaTokenArray::AddError() */
+#if 0
+                {
+                    sal_uInt16 n = pElement[ nId ];
+                    if (n < nP_Err)
+                        pScToken->AddError( pP_Err[ n ] );
+                    else
+                        bRet = false;
+                }
+#endif
                 break;
             case T_RefC:
-                pScToken->AddSingleReference( *ppP_RefTr[ pElement[ (sal_uInt16) nId ] ] );
+                {
+                    sal_uInt16 n = pElement[ nId ];
+                    ScSingleRefData* p = ( n < nP_RefTr )? ppP_RefTr[ n ] : NULL;
+                    if (p)
+                        pScToken->AddSingleReference( *p );
+                    else
+                        bRet = false;
+                }
                 break;
             case T_RefA:
                 {
-                ScComplexRefData    aScComplexRefData;
-                aScComplexRefData.Ref1 = *ppP_RefTr[ pElement[ nId ] ];
-                aScComplexRefData.Ref2 = *ppP_RefTr[ pElement[ nId ] + 1 ];
-                pScToken->AddDoubleReference( aScComplexRefData );
+                    sal_uInt16 n = pElement[ nId ];
+                    if (n < nP_RefTr && ppP_RefTr[ n ] && n+1 < nP_RefTr && ppP_RefTr[ n + 1 ])
+                    {
+                        ScComplexRefData	aScComplexRefData;
+                        aScComplexRefData.Ref1 = *ppP_RefTr[ n ];
+                        aScComplexRefData.Ref2 = *ppP_RefTr[ n + 1 ];
+                        pScToken->AddDoubleReference( aScComplexRefData );
+                    }
+                    else
+                        bRet = false;
                 }
                 break;
             case T_RN:
@@ -352,34 +467,39 @@ void TokenPool::GetElement( const sal_uInt16 nId )
             break;
             case T_Ext:
                 {
-                sal_uInt16          n = pElement[ nId ];
-                EXTCONT*        p = ( n < nP_Ext )? ppP_Ext[ n ] : NULL;
+                    sal_uInt16          n = pElement[ nId ];
+                    EXTCONT*        p = ( n < nP_Ext )? ppP_Ext[ n ] : NULL;
 
-                if( p )
-                {
-                    if( p->eId == ocEuroConvert )
-                        pScToken->AddOpCode( p->eId );
-                    else
-                        pScToken->AddExternal( p->aText, p->eId );
-                }
+                    if( p )
+                    {
+                        if( p->eId == ocEuroConvert )
+                            pScToken->AddOpCode( p->eId );
+                        else
+                            pScToken->AddExternal( p->aText, p->eId );
+                    }
+                    bRet = false;
                 }
                 break;
             case T_Nlf:
                 {
-                sal_uInt16          n = pElement[ nId ];
-                NLFCONT*        p = ( n < nP_Nlf )? ppP_Nlf[ n ] : NULL;
+                    sal_uInt16          n = pElement[ nId ];
+                    NLFCONT*        p = ( n < nP_Nlf )? ppP_Nlf[ n ] : NULL;
 
-                if( p )
-                        pScToken->AddColRowName( p->aRef );
+                    if( p )
+                            pScToken->AddColRowName( p->aRef );
+                    else
+                        bRet = false;
                 }
                 break;
             case T_Matrix:
                 {
-                sal_uInt16          n = pElement[ nId ];
-                ScMatrix*       p = ( n < nP_Matrix )? ppP_Matrix[ n ] : NULL;
+                    sal_uInt16          n = pElement[ nId ];
+                    ScMatrix*       p = ( n < nP_Matrix )? ppP_Matrix[ n ] : NULL;
 
-                if( p )
+                    if( p )
                         pScToken->AddMatrix( p );
+                    else
+                        bRet = false;
                 }
                 break;
             case T_ExtName:
@@ -390,6 +510,8 @@ void TokenPool::GetElement( const sal_uInt16 nId )
                     const ExtName& r = maExtNames[n];
                     pScToken->AddExternalName(r.mnFileId, r.maName);
                 }
+                else
+                    bRet = false;
             }
             break;
             case T_ExtRefC:
@@ -400,6 +522,8 @@ void TokenPool::GetElement( const sal_uInt16 nId )
                     const ExtCellRef& r = maExtCellRefs[n];
                     pScToken->AddExternalSingleReference(r.mnFileId, r.maTabName, r.maRef);
                 }
+                else
+                    bRet - false;
             }
             break;
             case T_ExtRefA:
@@ -410,126 +534,78 @@ void TokenPool::GetElement( const sal_uInt16 nId )
                     const ExtAreaRef& r = maExtAreaRefs[n];
                     pScToken->AddExternalDoubleReference(r.mnFileId, r.maTabName, r.maRef);
                 }
+                else
+                    bRet - false;
             }
             break;
             default:
-                OSL_FAIL("-TokenPool::GetElement(): Zustand undefiniert!?");
+                OSL_FAIL("-TokenPool::GetElement(): undefined state!?");
+                bRet = false;
         }
     }
+    return bRet;
 }
 
 
-void TokenPool::GetElementRek( const sal_uInt16 nId )
+bool TokenPool::GetElementRek( const sal_uInt16 nId )
 {
 #ifdef DBG_UTIL
     m_nRek++;
-    OSL_ENSURE(m_nRek <= nP_Id, "*TokenPool::GetElement(): recursion loop!?");
+    OSL_ENSURE(m_nRek <= nP_Id, "*TokenPool::GetElement(): recursion loops!?");
 #endif
 
-    OSL_ENSURE( nId < nElementAkt, "*TokenPool::GetElementRek(): Id zu gross!?" );
+    OSL_ENSURE( nId < nElementAkt, "*TokenPool::GetElementRek(): nId >= nElementAkt" );
 
-    OSL_ENSURE( pType[ nId ] == T_Id, "-TokenPool::GetElementRek(): nId nicht Id-Folge!" );
+    if (nId >= nElementAkt)
+    {
+        DBG_ERRORFILE( "*TokenPool::GetElementRek(): nId >= nElementAkt" );
+#ifdef DBG_UTIL
+        m_nRek--;
+#endif
+        return false;
+    }
 
+    if (pType[ nId ] != T_Id)
+    {
+        DBG_ERRORFILE( "-TokenPool::GetElementRek(): pType[ nId ] != T_Id" );
+#ifdef DBG_UTIL
+        m_nRek--;
+#endif
+        return false;
+    }
 
+
+    bool bRet = true;
     sal_uInt16      nAnz = pSize[ nId ];
-    sal_uInt16*     pAkt = &pP_Id[ pElement[ nId ] ];
+    sal_uInt16 nFirstId = pElement[ nId ];
+    if (nFirstId >= nP_Id)
+    {
+        DBG_ERRORFILE( "TokenPool::GetElementRek: nFirstId >= nP_Id");
+        nAnz = 0;
+        bRet = false;
+    }
+    sal_uInt16* pAkt = nAnz ? &pP_Id[ nFirstId ] : NULL;
+    if (nAnz > nP_Id - nFirstId)
+    {
+        DBG_ERRORFILE( "TokenPool::GetElementRek: nAnz > nP_Id - nFirstId");
+        nAnz = nP_Id - nFirstId;
+        bRet = false;
+    }
     for( ; nAnz > 0 ; nAnz--, pAkt++ )
     {
         if( *pAkt < nScTokenOff )
         {// Rekursion oder nicht?
-            switch( pType[ *pAkt ] )
+            if (*pAkt >= nElementAkt)
             {
-                case T_Id:
-                    GetElementRek( *pAkt );
-                    break;
-                case T_Str:
-                    pScToken->AddString( ppP_Str[ pElement[ *pAkt ] ]->GetBuffer() );
-                    break;
-                case T_D:
-                    pScToken->AddDouble( pP_Dbl[ pElement[ *pAkt ] ] );
-                    break;
-                case T_Err:
-                    break;
-                case T_RefC:
-                    pScToken->AddSingleReference( *ppP_RefTr[ pElement[ *pAkt ] ] );
-                    break;
-                case T_RefA:
-                    {
-                    ScComplexRefData    aScComplexRefData;
-                    aScComplexRefData.Ref1 = *ppP_RefTr[ pElement[ *pAkt ] ];
-                    aScComplexRefData.Ref2 = *ppP_RefTr[ pElement[ *pAkt ] + 1 ];
-                    pScToken->AddDoubleReference( aScComplexRefData );
-                    }
-                    break;
-                case T_RN:
-                {
-                    sal_uInt16 n = pElement[*pAkt];
-                    if (n < maRangeNames.size())
-                    {
-                        const RangeName& r = maRangeNames[n];
-                        pScToken->AddRangeName(r.mnIndex, r.mbGlobal);
-                    }
-                }
-                break;
-                case T_Ext:
-                    {
-                    sal_uInt16      n = pElement[ *pAkt ];
-                    EXTCONT*    p = ( n < nP_Ext )? ppP_Ext[ n ] : NULL;
-
-                    if( p )
-                        pScToken->AddExternal( p->aText, p->eId );
-                    }
-                    break;
-                case T_Nlf:
-                    {
-                    sal_uInt16      n = pElement[ *pAkt ];
-                    NLFCONT*    p = ( n < nP_Nlf )? ppP_Nlf[ n ] : NULL;
-
-                    if( p )
-                        pScToken->AddColRowName( p->aRef );
-                    }
-                    break;
-                case T_Matrix:
-                    {
-                    sal_uInt16          n = pElement[ *pAkt ];
-                    ScMatrix*       p = ( n < nP_Matrix )? ppP_Matrix[ n ] : NULL;
-
-                    if( p )
-                            pScToken->AddMatrix( p );
-                    }
-                    break;
-                case T_ExtName:
-                {
-                    sal_uInt16 n = pElement[*pAkt];
-                    if (n < maExtNames.size())
-                    {
-                        const ExtName& r = maExtNames[n];
-                        pScToken->AddExternalName(r.mnFileId, r.maName);
-                    }
-                }
-                break;
-                case T_ExtRefC:
-                {
-                    sal_uInt16 n = pElement[*pAkt];
-                    if (n < maExtCellRefs.size())
-                    {
-                        const ExtCellRef& r = maExtCellRefs[n];
-                        pScToken->AddExternalSingleReference(r.mnFileId, r.maTabName, r.maRef);
-                    }
-                }
-                break;
-                case T_ExtRefA:
-                {
-                    sal_uInt16 n = pElement[*pAkt];
-                    if (n < maExtAreaRefs.size())
-                    {
-                        const ExtAreaRef& r = maExtAreaRefs[n];
-                        pScToken->AddExternalDoubleReference(r.mnFileId, r.maTabName, r.maRef);
-                    }
-                }
-                break;
-                default:
-                    OSL_FAIL("-TokenPool::GetElementRek(): Zustand undefiniert!?");
+                DBG_ERRORFILE( "TokenPool::GetElementRek: *pAkt >= nElementAkt");
+                bRet = false;
+            }
+            else
+            {
+                if (pType[ *pAkt ] == T_Id)
+                    bRet = GetElementRek( *pAkt );
+                else
+                    bRet = GetElement( *pAkt );
             }
         }
         else    // elementarer SC_Token
@@ -540,6 +616,7 @@ void TokenPool::GetElementRek( const sal_uInt16 nId )
 #ifdef DBG_UTIL
     m_nRek--;
 #endif
+    return bRet;
 }
 
 
@@ -548,7 +625,8 @@ void TokenPool::operator >>( TokenId& rId )
     rId = ( TokenId ) ( nElementAkt + 1 );
 
     if( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return;
 
     pElement[ nElementAkt ] = nP_IdLast;    // Start der Token-Folge
     pType[ nElementAkt ] = T_Id;            // Typinfo eintragen
@@ -563,10 +641,12 @@ void TokenPool::operator >>( TokenId& rId )
 const TokenId TokenPool::Store( const double& rDouble )
 {
     if( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     if( nP_DblAkt >= nP_Dbl )
-        GrowDouble();
+		if (!GrowDouble())
+            return (const TokenId) nElementAkt+1;
 
     pElement[ nElementAkt ] = nP_DblAkt;    // Index in Double-Array
     pType[ nElementAkt ] = T_D;             // Typinfo Double eintragen
@@ -593,10 +673,14 @@ const TokenId TokenPool::Store( const String& rString )
     // weitgehend nach Store( const sal_Char* ) kopiert, zur Vermeidung
     //  eines temporaeren Strings in "
     if( nElementAkt >= nElement )
-        GrowElement();
+        if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
+
 
     if( nP_StrAkt >= nP_Str )
-        GrowString();
+        if (!GrowString())
+            return (const TokenId) nElementAkt+1;
+
 
     pElement[ nElementAkt ] = nP_StrAkt;    // Index in String-Array
     pType[ nElementAkt ] = T_Str;           // Typinfo String eintragen
@@ -604,14 +688,16 @@ const TokenId TokenPool::Store( const String& rString )
     // String anlegen
     if( !ppP_Str[ nP_StrAkt ] )
         //...aber nur, wenn noch nicht vorhanden
-        ppP_Str[ nP_StrAkt ] = new String( rString );
+		ppP_Str[ nP_StrAkt ] = new (::std::nothrow) String( rString );
     else
         //...ansonsten nur kopieren
         *ppP_Str[ nP_StrAkt ] = rString;
 
-    OSL_ENSURE( sizeof( xub_StrLen ) <= 2, "*TokenPool::Store(): StrLen doesn't match!" );
-
-    pSize[ nElementAkt ] = ( sal_uInt16 ) ppP_Str[ nP_StrAkt ]->Len();
+    if (ppP_Str[ nP_StrAkt ])
+    {
+        DBG_ASSERT( sizeof( xub_StrLen ) <= 2, "*TokenPool::Store(): StrLen doesn't match!" );
+        pSize[ nElementAkt ] = ( sal_uInt16 ) ppP_Str[ nP_StrAkt ]->Len();
+    }
 
     nElementAkt++;
     nP_StrAkt++;
@@ -623,10 +709,12 @@ const TokenId TokenPool::Store( const String& rString )
 const TokenId TokenPool::Store( const ScSingleRefData& rTr )
 {
     if( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     if( nP_RefTrAkt >= nP_RefTr )
-        GrowTripel();
+		if (!GrowTripel())
+            return (const TokenId) nElementAkt+1;
 
     pElement[ nElementAkt ] = nP_RefTrAkt;
     pType[ nElementAkt ] = T_RefC;          // Typinfo Cell-Reff eintragen
@@ -646,10 +734,12 @@ const TokenId TokenPool::Store( const ScSingleRefData& rTr )
 const TokenId TokenPool::Store( const ScComplexRefData& rTr )
 {
     if( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     if( nP_RefTrAkt + 1 >= nP_RefTr )
-        GrowTripel();
+		if (!GrowTripel( 2))
+            return (const TokenId) nElementAkt+1;
 
     pElement[ nElementAkt ] = nP_RefTrAkt;
     pType[ nElementAkt ] = T_RefA;          // Typinfo Area-Reff eintragen
@@ -675,10 +765,12 @@ const TokenId TokenPool::Store( const ScComplexRefData& rTr )
 const TokenId TokenPool::Store( const DefTokenId e, const String& r )
 {
     if( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     if( nP_ExtAkt >= nP_Ext )
-        GrowExt();
+        if (!GrowExt())
+            return (const TokenId) nElementAkt+1;
 
     pElement[ nElementAkt ] = nP_ExtAkt;
     pType[ nElementAkt ] = T_Ext;           // Typinfo String eintragen
@@ -701,10 +793,12 @@ const TokenId TokenPool::Store( const DefTokenId e, const String& r )
 const TokenId TokenPool::StoreNlf( const ScSingleRefData& rTr )
 {
     if( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     if( nP_NlfAkt >= nP_Nlf )
-        GrowNlf();
+		if (!GrowNlf())
+            return (const TokenId) nElementAkt+1;
 
     pElement[ nElementAkt ] = nP_NlfAkt;
     pType[ nElementAkt ] = T_Nlf;
@@ -727,10 +821,12 @@ const TokenId TokenPool::StoreMatrix()
     ScMatrix* pM;
 
     if( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     if( nP_MatrixAkt >= nP_Matrix )
-        GrowMatrix();
+        if (!GrowMatrix())
+            return (const TokenId) nElementAkt+1;
 
     pElement[ nElementAkt ] = nP_MatrixAkt;
     pType[ nElementAkt ] = T_Matrix;
@@ -748,7 +844,8 @@ const TokenId TokenPool::StoreMatrix()
 const TokenId TokenPool::StoreName( sal_uInt16 nIndex, bool bGlobal )
 {
     if ( nElementAkt >= nElement )
-        GrowElement();
+        if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     pElement[nElementAkt] = static_cast<sal_uInt16>(maRangeNames.size());
     pType[nElementAkt] = T_RN;
@@ -766,7 +863,8 @@ const TokenId TokenPool::StoreName( sal_uInt16 nIndex, bool bGlobal )
 const TokenId TokenPool::StoreExtName( sal_uInt16 nFileId, const String& rName )
 {
     if ( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     pElement[nElementAkt] = static_cast<sal_uInt16>(maExtNames.size());
     pType[nElementAkt] = T_ExtName;
@@ -784,7 +882,8 @@ const TokenId TokenPool::StoreExtName( sal_uInt16 nFileId, const String& rName )
 const TokenId TokenPool::StoreExtRef( sal_uInt16 nFileId, const String& rTabName, const ScSingleRefData& rRef )
 {
     if ( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     pElement[nElementAkt] = static_cast<sal_uInt16>(maExtCellRefs.size());
     pType[nElementAkt] = T_ExtRefC;
@@ -803,7 +902,8 @@ const TokenId TokenPool::StoreExtRef( sal_uInt16 nFileId, const String& rTabName
 const TokenId TokenPool::StoreExtRef( sal_uInt16 nFileId, const String& rTabName, const ScComplexRefData& rRef )
 {
     if ( nElementAkt >= nElement )
-        GrowElement();
+		if (!GrowElement())
+            return (const TokenId) nElementAkt+1;
 
     pElement[nElementAkt] = static_cast<sal_uInt16>(maExtAreaRefs.size());
     pType[nElementAkt] = T_ExtRefA;
@@ -839,10 +939,14 @@ sal_Bool TokenPool::IsSingleOp( const TokenId& rId, const DefTokenId eId ) const
         {// Tokenfolge?
             if( pSize[ nId ] == 1 )
             {// GENAU 1 Token
-                sal_uInt16  nSecId = pP_Id[ pElement[ nId ] ];
-                if( nSecId >= nScTokenOff )
-                {// Default-Token?
-                    return ( DefTokenId ) ( nSecId - nScTokenOff ) == eId;  // Gesuchter?
+                sal_uInt16 nPid = pElement[ nId ];
+                if (nPid < nP_Id)
+                {
+                    sal_uInt16	nSecId = pP_Id[ nPid ];
+                    if( nSecId >= nScTokenOff )
+                    {// Default-Token?
+                        return ( DefTokenId ) ( nSecId - nScTokenOff ) == eId;	// Gesuchter?
+                    }
                 }
             }
         }
@@ -858,8 +962,12 @@ const String* TokenPool::GetExternal( const TokenId& rId ) const
     if( n && n <= nElementAkt )
     {
         n--;
-        if( (pType[ n ] == T_Ext) && ppP_Ext[ pElement[ n ] ] )
-            p = &ppP_Ext[ pElement[ n ] ]->aText;
+        if( (pType[ n ] == T_Ext) )
+        {
+            sal_uInt16 nExt = pElement[ n ];
+            if ( nExt < nP_Ext && ppP_Ext[ nExt ] )
+                p = &ppP_Ext[ nExt ]->aText;
+        }
     }
 
     return p;
diff --git a/sc/source/filter/inc/lotfntbf.hxx b/sc/source/filter/inc/lotfntbf.hxx
index cb90efc3fc3d..7a024e584e79 100644
--- a/sc/source/filter/inc/lotfntbf.hxx
+++ b/sc/source/filter/inc/lotfntbf.hxx
@@ -97,14 +97,15 @@ private:
         inline void         Type( const sal_uInt16 nNew )       { nType = nNew; }
     };
 
-    ENTRY                   pData[ 8 ];
-    const static sal_uInt16     nSize;
     void                    MakeFont( ENTRY* pEntry );
 public:
+	const static sal_uInt16	nSize = 8;
     void                    Fill( const sal_uInt8 nIndex, SfxItemSet& rItemSet );
     void                    SetName( const sal_uInt16 nIndex, const String& rName );
     void                    SetHeight( const sal_uInt16 nIndex, const sal_uInt16 nHeight );
     void                    SetType( const sal_uInt16 nIndex, const sal_uInt16 nType );
+private:
+	ENTRY					pData[ nSize ];
 };
 
 
diff --git a/sc/source/filter/inc/lotimpop.hxx b/sc/source/filter/inc/lotimpop.hxx
index d714611e03bd..b41034c00f02 100644
--- a/sc/source/filter/inc/lotimpop.hxx
+++ b/sc/source/filter/inc/lotimpop.hxx
@@ -45,7 +45,6 @@ class ImportLotus : public ImportTyp
 {
 private:
     SvStream*           pIn;            // benoetigt wegen multiplem Read()!
-    LotusFontBuffer*    pFontBuff;
     LotusToSc           aConv;
     sal_uInt16              nTab;           // z.Zt. bearbeitete Tabelle
     sal_Int32               nExtTab;
diff --git a/sc/source/filter/inc/root.hxx b/sc/source/filter/inc/root.hxx
index 4c9800216a0f..0aef856c46e4 100644
--- a/sc/source/filter/inc/root.hxx
+++ b/sc/source/filter/inc/root.hxx
@@ -110,6 +110,9 @@ struct LOTUS_ROOT
     RangeNameBufferWK3* pRngNmBffWK3;
     LotusFontBuffer*    pFontBuff;
     LotAttrTable*       pAttrTable;
+
+                        LOTUS_ROOT( ScDocument* pDocP, CharSet eQ );
+                        ~LOTUS_ROOT();
 };
 
 extern LOTUS_ROOT*      pLotusRoot; // -> Inkarn. in filter.cxx
diff --git a/sc/source/filter/inc/tokstack.hxx b/sc/source/filter/inc/tokstack.hxx
index 550f9e3a9c94..8d70c530c95e 100644
--- a/sc/source/filter/inc/tokstack.hxx
+++ b/sc/source/filter/inc/tokstack.hxx
@@ -182,16 +182,20 @@ class TokenPool
 #endif
         ScTokenArray*               pScToken;   // Tokenbastler
 
-        void                        GrowString( void );
-        void                        GrowDouble( void );
-        void                        GrowTripel( void );
-        void                        GrowId( void );
-        void                        GrowElement( void );
-        void                        GrowExt( void );
-        void                        GrowNlf( void );
-        void                        GrowMatrix( void );
-        void                        GetElement( const sal_uInt16 nId );
-        void                        GetElementRek( const sal_uInt16 nId );
+		bool						GrowString( void );
+		bool						GrowDouble( void );
+/* TODO: in case we had FormulaTokenArray::AddError() */
+#if 0
+        bool                        GrowError( void );
+#endif
+		bool						GrowTripel( sal_uInt16 nByMin = 1 );
+		bool						GrowId( void );
+		bool						GrowElement( void );
+		bool						GrowExt( void );
+		bool						GrowNlf( void );
+		bool						GrowMatrix( void );
+		bool						GetElement( const sal_uInt16 nId );
+		bool						GetElementRek( const sal_uInt16 nId );
     public:
                                     TokenPool( void );
                                     ~TokenPool();
@@ -315,7 +319,8 @@ inline TokenPool& TokenPool::operator <<( const TokenId nId )
         "-TokenPool::operator <<: TokenId im DefToken-Bereich!" );
 
     if( nP_IdAkt >= nP_Id )
-        GrowId();
+		if (!GrowId())
+            return *this;
 
     pP_Id[ nP_IdAkt ] = ( ( sal_uInt16 ) nId ) - 1;
     nP_IdAkt++;
@@ -330,7 +335,8 @@ inline TokenPool& TokenPool::operator <<( const DefTokenId eId )
         "-TokenPool::operator<<: enmum zu gross!" );
 
     if( nP_IdAkt >= nP_Id )
-        GrowId();
+		if (!GrowId())
+            return *this;
 
     pP_Id[ nP_IdAkt ] = ( ( sal_uInt16 ) eId ) + nScTokenOff;
     nP_IdAkt++;
@@ -342,7 +348,8 @@ inline TokenPool& TokenPool::operator <<( const DefTokenId eId )
 inline TokenPool& TokenPool::operator <<( TokenStack& rStack )
 {
     if( nP_IdAkt >= nP_Id )
-        GrowId();
+		if (!GrowId())
+            return *this;
 
     pP_Id[ nP_IdAkt ] = ( ( sal_uInt16 ) rStack.Get() ) - 1;
     nP_IdAkt++;
diff --git a/sc/source/filter/lotus/filter.cxx b/sc/source/filter/lotus/filter.cxx
index 96a97ffa2560..cd783516bcd1 100644
--- a/sc/source/filter/lotus/filter.cxx
+++ b/sc/source/filter/lotus/filter.cxx
@@ -63,9 +63,6 @@ WKTYP               eTyp;
 extern sal_Bool         bEOF;           // zeigt Ende der Datei
 sal_Bool                bEOF;
 
-extern CharSet      eCharNach;      // Zeichenkonvertierung von->nach
-CharSet             eCharNach;
-
 extern CharSet      eCharVon;
 CharSet             eCharVon;
 
@@ -73,16 +70,11 @@ extern ScDocument*  pDoc;           // Aufhaenger zum Dokumentzugriff
 ScDocument*         pDoc;
 
 
-extern sal_Char*    pPuffer;        // -> memory.cxx
-extern sal_Char*    pDummy1;        // -> memory.cxx
-
 extern OPCODE_FKT   pOpFkt[ FKT_LIMIT ];
                                     // -> optab.cxx, Tabelle moeglicher Opcodes
 extern OPCODE_FKT   pOpFkt123[ FKT_LIMIT123 ];
                                     // -> optab.cxx, Table of possible Opcodes
 
-extern long         nDateiLaenge;   // -> datei.cpp, ...der gerade offenen Datei
-
 LOTUS_ROOT*         pLotusRoot = NULL;
 
 
@@ -196,9 +188,10 @@ WKTYP ScanVersion( SvStream& aStream )
             aStream >> nVersNr;
             if( aStream.IsEof() ) return eWK_Error;
             if( nVersNr == 0x0004 && nRecLen == 26 )
-            {   // 4 Bytes von 26 gelesen->22 ueberlesen
-                aStream.Read( pDummy1, 22 );
-                return eWK3;
+			{	// 4 bytes of 26 read => skip 22 (read instead of seek to make IsEof() work just in case)
+                sal_Char aDummy[22];
+                aStream.Read( aDummy, 22 );
+                return aStream.IsEof() ? eWK_Error : eWK3;
             }
             break;
         case 0x1003:
diff --git a/sc/source/filter/lotus/lotattr.cxx b/sc/source/filter/lotus/lotattr.cxx
index e21e84778278..7f5f3ab2447c 100644
--- a/sc/source/filter/lotus/lotattr.cxx
+++ b/sc/source/filter/lotus/lotattr.cxx
@@ -187,7 +187,7 @@ void LotAttrCache::LotusToScBorderLine( sal_uInt8 nLine, ::editeng::SvxBorderLin
 const SvxColorItem& LotAttrCache::GetColorItem( const sal_uInt8 nLotIndex ) const
 {
     OSL_ENSURE( nLotIndex > 0 && nLotIndex < 7,
-        "-LotAttrCache::GetColorItem(): so nicht!" );
+		"-LotAttrCache::GetColorItem(): caller hast to check index!" );
 
     return *ppColorItems[ nLotIndex - 1 ];
 }
@@ -195,13 +195,15 @@ const SvxColorItem& LotAttrCache::GetColorItem( const sal_uInt8 nLotIndex ) cons
 const Color& LotAttrCache::GetColor( const sal_uInt8 nLotIndex ) const
 {
     // Farbe <-> Index passt fuer Background, nicht aber fuer Fonts (0 <-> 7)!
-    OSL_ENSURE( nLotIndex < 8, "*LotAttrCache::GetColor(): Index > 7!" );
+	OSL_ENSURE( nLotIndex < 8, "*LotAttrCache::GetColor(): Index > 7, caller hast to check index!" );
 
     return pColTab[ nLotIndex ];
 }
 
 void LotAttrCol::SetAttr( const SCROW nRow, const ScPatternAttr& rAttr )
 {
+    // Actually with the current implementation of MAXROWCOUNT>=64k and nRow
+    // being read as sal_uInt16 there's no chance that nRow would be invalid..
     OSL_ENSURE( ValidRow(nRow), "*LotAttrCol::SetAttr(): ... und rums?!" );
 
     boost::ptr_vector<ENTRY>::reverse_iterator iterLast = aEntries.rbegin();
@@ -246,6 +248,9 @@ void LotAttrCol::Apply( const SCCOL nColNum, const SCTAB nTabNum )
 void LotAttrTable::SetAttr( const SCCOL nColFirst, const SCCOL nColLast, const SCROW nRow,
                             const LotAttrWK3& rAttr )
 {
+    // With the current implementation of MAXCOLCOUNT>=1024 and nColFirst and
+    // nColLast being calculated as sal_uInt8+sal_uInt8 there's no chance that
+    // they would be invalid.
     const ScPatternAttr &rPattAttr = aAttrCache.GetPattAttr( rAttr );
     SCCOL nColCnt;
 
diff --git a/sc/source/filter/lotus/lotform.cxx b/sc/source/filter/lotus/lotform.cxx
index c9457d8ff7ad..ebc77b44fea9 100644
--- a/sc/source/filter/lotus/lotform.cxx
+++ b/sc/source/filter/lotus/lotform.cxx
@@ -125,7 +125,8 @@ void LotusToSc::DoFunc( DefTokenId eOc, sal_uInt8 nAnz, const sal_Char* pExtStri
             break;
         case ocChose:
         {// 1. Parameter ++
-            IncToken( eParam[ nAnz - 1 ] );
+            if (nAnz >= 1)
+                IncToken( eParam[ nAnz - 1 ] );
         }
             break;
         case ocFind:
@@ -138,7 +139,8 @@ void LotusToSc::DoFunc( DefTokenId eOc, sal_uInt8 nAnz, const sal_Char* pExtStri
         case ocMid:
         case ocReplace:
         {// 2. Parameter ++
-            IncToken( eParam[ nAnz - 2 ] );
+            if (nAnz >= 2)
+                IncToken( eParam[ nAnz - 2 ] );
         }
             break;
         case ocZins:
@@ -607,14 +609,18 @@ ConvErr LotusToSc::Convert( const ScTokenArray*& rpErg, sal_Int32& rRest,
 
                 if( nStrLen )
                 {
-//                  String  t( ReadString( aIn, nStrLen, eSrcChar ) );
-                    sal_Char*   p = new sal_Char[ nStrLen + 1 ];
-                    aIn.Read( p, nStrLen );
-                    p[ nStrLen ] = 0x00;
+					sal_Char*	p = new (::std::nothrow) sal_Char[ nStrLen + 1 ];
+                    if (p)
+                    {
+                        aIn.Read( p, nStrLen );
+                        p[ nStrLen ] = 0x00;
 
-                    DoFunc( ocNoName, nAnz, p );
+                        DoFunc( ocNoName, nAnz, p );
 
-                    delete[] p;
+                        delete[] p;
+                    }
+                    else
+                        DoFunc( ocNoName, nAnz, NULL );
                 }
                 else
                     DoFunc( ocNoName, nAnz, NULL );
@@ -1994,7 +2000,7 @@ const sal_Char* GetAddInName( const sal_uInt8 n )
 }
 
 
-DefTokenId lcl_KnownAddIn( const rtl::OString& rTest )
+static DefTokenId lcl_KnownAddIn( const rtl::OString& rTest )
 {
     DefTokenId  eId = ocNoName;
 
diff --git a/sc/source/filter/lotus/lotimpop.cxx b/sc/source/filter/lotus/lotimpop.cxx
index 46c38b6193ea..4eda7c531892 100644
--- a/sc/source/filter/lotus/lotimpop.cxx
+++ b/sc/source/filter/lotus/lotimpop.cxx
@@ -46,6 +46,29 @@
 #include "lotrange.hxx"
 #include "lotattr.hxx"
 
+LOTUS_ROOT::LOTUS_ROOT( ScDocument* pDocP, CharSet eQ )
+    :
+        pDoc( pDocP),
+        pRangeNames( new LotusRangeList),
+        pScRangeName( pDocP->GetRangeName()),
+        eCharsetQ( eQ),
+        eFirstType( Lotus_X),
+        eActType( Lotus_X),
+        pRngNmBffWK3( new RangeNameBufferWK3),
+        pFontBuff( new LotusFontBuffer),
+        pAttrTable( new LotAttrTable)
+{
+}
+
+
+LOTUS_ROOT::~LOTUS_ROOT()
+{
+	delete pRangeNames;
+	delete pRngNmBffWK3;
+	delete pFontBuff;
+	delete pAttrTable;
+}
+
 
 static osl::Mutex aLotImpSemaphore;
 
@@ -58,30 +81,14 @@ ImportLotus::ImportLotus( SvStream& aStream, ScDocument* pDoc, CharSet eQ ) :
     // good point to start locking of import lotus
     aLotImpSemaphore.acquire();
 
-    pLotusRoot = new LOTUS_ROOT;
-    pLotusRoot->pDoc = pDoc;
-    pLotusRoot->pRangeNames = new LotusRangeList;
-    pLotusRoot->pScRangeName = pDoc->GetRangeName();
-    pLotusRoot->eCharsetQ = eQ;
-    pLotusRoot->eFirstType = Lotus_X;
-    pLotusRoot->eActType = Lotus_X;
-    pLotusRoot->pRngNmBffWK3 = new RangeNameBufferWK3;
-    pFontBuff = pLotusRoot->pFontBuff = new LotusFontBuffer;
-    pLotusRoot->pAttrTable = new LotAttrTable;
+	pLotusRoot = new LOTUS_ROOT( pDoc, eQ);
 }
 
 
 ImportLotus::~ImportLotus()
 {
-    delete pLotusRoot->pRangeNames;
-    delete pLotusRoot->pRngNmBffWK3;
-    delete pFontBuff;
-    delete pLotusRoot->pAttrTable;
     delete pLotusRoot;
-
-#if OSL_DEBUG_LEVEL > 0
     pLotusRoot = NULL;
-#endif
 
     // no need 4 pLotusRoot anymore
     aLotImpSemaphore.release();
@@ -132,7 +139,7 @@ void ImportLotus::Columnwidth( sal_uInt16 nRecLen )
     OSL_ENSURE( nRecLen >= 4, "*ImportLotus::Columnwidth(): Record zu kurz!" );
 
     sal_uInt8    nLTab, nWindow2;
-    sal_uInt16  nCnt = ( nRecLen - 4 ) / 2;
+	sal_uInt16	nCnt = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 2;
 
     Read( nLTab );
     Read( nWindow2 );
@@ -164,7 +171,7 @@ void ImportLotus::Hiddencolumn( sal_uInt16 nRecLen )
     OSL_ENSURE( nRecLen >= 4, "*ImportLotus::Hiddencolumn(): Record zu kurz!" );
 
     sal_uInt8    nLTab, nWindow2;
-    sal_uInt16  nCnt = ( nRecLen - 4 ) / 2;
+	sal_uInt16	nCnt = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 2;
 
     Read( nLTab );
     Read( nWindow2 );
@@ -190,18 +197,17 @@ void ImportLotus::Userrange( void )
 {
     sal_uInt16      nRangeType;
     ScRange     aScRange;
-    sal_Char*   pBuffer = new sal_Char[ 32 ];
 
     Read( nRangeType );
 
-    pIn->Read( pBuffer, 16 );
-    pBuffer[ 16 ] = ( sal_Char ) 0x00;  // zur Sicherheit...
-    String      aName( pBuffer, eQuellChar );
+	sal_Char aBuffer[ 17 ];
+	pIn->Read( aBuffer, 16 );
+	aBuffer[ 16 ] = 0;
+	String		aName( aBuffer, eQuellChar );
 
     Read( aScRange );
 
     pLotusRoot->pRngNmBffWK3->Add( aName, aScRange );
-    delete[] pBuffer;
 }
 
 
@@ -242,7 +248,7 @@ void ImportLotus::Labelcell( void )
 
 
 void ImportLotus::Numbercell( void )
-    {
+{
     ScAddress   aAddr;
     double      fVal;
 
@@ -276,7 +282,7 @@ ScFormulaCell *ImportLotus::Formulacell( sal_uInt16 n )
     Read( aAddr );
     Skip( 10 );
 
-    n -= 14;
+	n -= (n > 14) ? 14 : n;
 
     const ScTokenArray* pErg;
     sal_Int32               nRest = n;
@@ -292,7 +298,7 @@ ScFormulaCell *ImportLotus::Formulacell( sal_uInt16 n )
     pD->PutCell( aAddr.Col(), aAddr.Row(), aAddr.Tab(), pZelle, true );
 
     return NULL;
-    }
+}
 
 
 void ImportLotus::Read( String &r )
@@ -307,7 +313,7 @@ void ImportLotus::RowPresentation( sal_uInt16 nRecLen )
 
     sal_uInt8    nLTab, nFlags;
     sal_uInt16  nRow, nHeight;
-    sal_uInt16  nCnt = ( nRecLen - 4 ) / 8;
+	sal_uInt16	nCnt = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 8;
 
     Read( nLTab );
     Skip( 1 );
@@ -358,52 +364,44 @@ void ImportLotus::Font_Face( void )
 
     Read( nNum );
 
-    // ACHTUNG: QUICK-HACK gegen unerklaerliche Loops
-    if( nNum > 7 )
-        return;
-    // ACHTUNG
+	if( nNum >= LotusFontBuffer::nSize )
+		return;     // nonsense
 
     Read( aName );
 
-    pFontBuff->SetName( nNum, aName );
+	pLotusRoot->pFontBuff->SetName( nNum, aName );
 }
 
 
 void ImportLotus::Font_Type( void )
 {
-    static const sal_uInt16 nAnz = 8;
-    sal_uInt16              nCnt;
-    sal_uInt16              nType;
-
-    for( nCnt = 0 ; nCnt < nAnz ; nCnt++ )
+	for( sal_uInt16 nCnt = 0 ; nCnt < LotusFontBuffer::nSize ; nCnt++ )
     {
+        sal_uInt16 nType;
         Read( nType );
-        pFontBuff->SetType( nCnt, nType );
+		pLotusRoot->pFontBuff->SetType( nCnt, nType );
     }
 }
 
 
 void ImportLotus::Font_Ysize( void )
 {
-    static const sal_uInt16 nAnz = 8;
-    sal_uInt16              nCnt;
-    sal_uInt16              nSize;
-
-    for( nCnt = 0 ; nCnt < nAnz ; nCnt++ )
+	for( sal_uInt16 nCnt = 0 ; nCnt < LotusFontBuffer::nSize ; nCnt++ )
     {
+        sal_uInt16 nSize;
         Read( nSize );
-        pFontBuff->SetHeight( nCnt, nSize );
+		pLotusRoot->pFontBuff->SetHeight( nCnt, nSize );
     }
 }
 
 
 void ImportLotus::_Row( const sal_uInt16 nRecLen )
-    {
+{
     OSL_ENSURE( nExtTab >= 0, "*ImportLotus::_Row(): Kann hier nicht sein!" );
 
     sal_uInt16          nRow;
     sal_uInt16          nHeight;
-    sal_uInt16          nCntDwn = ( nRecLen - 4 ) / 5;
+	sal_uInt16			nCntDwn = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 5;
     SCCOL           nColCnt = 0;
     sal_uInt8           nRepeats;
     LotAttrWK3      aAttr;
@@ -467,7 +465,5 @@ void ImportLotus::_Row( const sal_uInt16 nRecLen )
     if( bCenter )
         // evtl. alte Center bemachen
         pD->DoMerge( static_cast<SCTAB> (nExtTab), nCenterStart, static_cast<SCROW> (nRow), nCenterEnd, static_cast<SCROW> (nRow) );
-    }
-
-
+}
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sc/source/filter/lotus/lotread.cxx b/sc/source/filter/lotus/lotread.cxx
index 8384825d1723..11d41b1bdc74 100644
--- a/sc/source/filter/lotus/lotread.cxx
+++ b/sc/source/filter/lotus/lotread.cxx
@@ -76,7 +76,7 @@ FltError ImportLotus::Read()
     {
         *pIn >> nOp >> nRecLen;
 
-        if( pIn->IsEof() )
+		if( pIn->IsEof() || nNextRec > SAL_MAX_UINT32 - nRecLen - 4 )
             eAkt = S_END;
 
         nNextRec += nRecLen + 4;
@@ -171,17 +171,25 @@ FltError ImportLotus::Read()
                 break;
 
                 case 0x001b:                            // extended attributes
-                Read( nSubType );
-                nRecLen -= 2;
-                switch( nSubType )
+                if (nRecLen > 2)
                 {
-                    case 2007:                              // ROW PRESENTATION
-                    RowPresentation( nRecLen );
-                    break;
+                    Read( nSubType );
+                    nRecLen -= 2;
+                    switch( nSubType )
+                    {
+                        case 2007:                      // ROW PRESENTATION
+                            RowPresentation( nRecLen );
+                            break;
 
-                    case 14000:                             // NAMED SHEET
-                    NamedSheet();
-                    break;
+                        case 14000:                     // NAMED SHEET
+                            NamedSheet();
+                            break;
+                    }
+                }
+                else
+                {
+                    eRet = eERR_FORMAT;
+                    eAkt = S_END;
                 }
             }
 
@@ -192,12 +200,6 @@ FltError ImportLotus::Read()
             // -----------------------------------------------------------
             case S_END:                                             // S_END
             break;
-            // -----------------------------------------------------------
-#if OSL_DEBUG_LEVEL > 0
-            default:
-            OSL_FAIL( "*ImportLotus::Read(): State unbekannt!" );
-            eAkt = S_END;
-#endif
         }
 
         OSL_ENSURE( nNextRec >= pIn->Tell(),
@@ -262,7 +264,7 @@ FltError ImportLotus::Read( SvStream& rIn )
     {
         *pIn >> nOp >> nRecLen;
 
-        if( pIn->IsEof() )
+		if( pIn->IsEof() || nNextRec > SAL_MAX_UINT32 - nRecLen - 4 )
             bRead = false;
         else
         {
diff --git a/sc/source/filter/lotus/memory.cxx b/sc/source/filter/lotus/memory.cxx
index cf3c0535e372..905bea3c686b 100644
--- a/sc/source/filter/lotus/memory.cxx
+++ b/sc/source/filter/lotus/memory.cxx
@@ -41,38 +41,10 @@
 #include "decl.h"
 #include "tool.h"
 
-extern const long       nStackSize;
-extern const int        nAnzNRange;
-
 extern ScDocument*      pDoc;
 
-const long              nStackSize = 8L * 1024;     // -> form_xxx.cpp
-const int               nAnzNRange = 2048;          // -> tool_xxx.cpp, max. 2048 Named Ranges
-
-sal_Char*               pPuffer;                    // -> flt_xxx.cxx
-sal_Char*               pDummy1;                    // -> flt_xxx.cxx, ScanVersion()
-sal_Char*               pDummy2;                    // -> tool.cxx, CreateTable()
-
-extern sal_uInt8*           pFormelBuffer;              // -> tool.cxx, fuer OP_Formula()
-sal_uInt8*                  pFormelBuffer;
-
 extern FormCache*       pValueFormCache;            // -> tool.cxx
 
-sal_Char*               pStack;                     // -> formel.cxx
-sal_Char*               pPuffer0;                   // -> formel.cxx
-sal_Char*               pPuffer1;                   // -> formel.cxx
-extern const int        nMaxPar;
-const int               nMaxPar = 128;              // max. 128 Parameter werden unterstuetzt
-sal_Char**              pPar;                       // -> formel.cxx, Pn()
-
-#ifndef _DOS                                        // -> op.cxx
-sal_Char*               pAnsi;
-#endif
-sal_Char*               pErgebnis;                  // -> op.cxx
-
-extern sal_Bool             bFormInit;                  // -> tool.cxx, fuer GetFormHandle()
-sal_Bool                    bFormInit;
-
 extern SvxHorJustifyItem    *pAttrRight, *pAttrLeft, *pAttrCenter,
                             *pAttrRepeat, *pAttrStandard;   // -> tool.cxx, fuer GetFormAttr()
 extern ScProtectionAttr*    pAttrUnprot;   // -> tool.cxx, fuer PutFormString()
@@ -81,25 +53,6 @@ extern ScProtectionAttr*    pAttrUnprot;   // -> tool.cxx, fuer PutFormString()
 
 sal_Bool MemNew( void )
 {
-    pPuffer = new sal_Char [ 32L*1024L ];
-
-    pDummy1 = new sal_Char [ 32 ];
-
-    pDummy2 = new sal_Char [ 32 ];
-
-    pStack = new sal_Char [ nStackSize * 3 ];   // alle drei auf einmal
-
-    pPuffer0 = pStack + nStackSize;
-    pPuffer1 = pPuffer0 + nStackSize;
-
-    pAnsi = new sal_Char [ 2048 ];
-
-    pErgebnis = new sal_Char [ 32L*1024L ];
-
-    pPar = new sal_Char *[ nMaxPar ];
-
-    pFormelBuffer = new sal_uInt8[ 4096 ];
-
     pValueFormCache = new FormCache( pDoc );
 
     // fuer tool.cxx::PutFormString()
@@ -109,7 +62,6 @@ sal_Bool MemNew( void )
     pAttrCenter = new SvxHorJustifyItem( SVX_HOR_JUSTIFY_CENTER, ATTR_HOR_JUSTIFY );
     pAttrRepeat = new SvxHorJustifyItem( SVX_HOR_JUSTIFY_REPEAT, ATTR_HOR_JUSTIFY );
     pAttrStandard = new SvxHorJustifyItem( SVX_HOR_JUSTIFY_STANDARD, ATTR_HOR_JUSTIFY );
-    bFormInit = sal_True;
 
     return sal_True;
 }
@@ -117,15 +69,6 @@ sal_Bool MemNew( void )
 
 void MemDelete( void )
 {
-    delete[] pPuffer;
-    delete[] pDummy1;
-    delete[] pDummy2;
-    delete[] pStack;
-    delete[] pAnsi;
-    delete[] pErgebnis;
-    delete[] pPar;
-    delete[] pFormelBuffer;
-
     delete pValueFormCache;
     delete pAttrRight;
     delete pAttrLeft;
diff --git a/sc/source/filter/lotus/op.cxx b/sc/source/filter/lotus/op.cxx
index a94786f5a41f..bd94432c27be 100644
--- a/sc/source/filter/lotus/op.cxx
+++ b/sc/source/filter/lotus/op.cxx
@@ -36,9 +36,7 @@
 #include <string.h>
 #include <math.h>
 #include <ctype.h>
-#if defined( ICC )
 #include <stdlib.h>
-#endif
 
 #include "scitems.hxx"
 #include "patattr.hxx"
@@ -68,15 +66,10 @@
 #include <vector>
 #include <map>
 
-extern sal_Char*    pAnsi;          // -> memory.cxx, Puffer zum Umwandeln von OEM->ANSI
-extern sal_Char*    pErgebnis;      // -> memory.cxx, Ergebnispuffer
 extern WKTYP        eTyp;           // -> filter.cxx, aktueller Dateityp
 extern sal_Bool         bEOF;           // -> filter.cxx, zeigt Dateiende an
-extern sal_Char*    pPuffer0;       // -> memory.cxx
-extern sal_Char*    pPuffer1;
 extern sal_uInt8            nDefaultFormat; // -> tool.cxx, Default-Zellenformat
 extern ScDocument*  pDoc;           // -> filter.cxx, Aufhaenger zum Dokumentzugriff
-extern sal_uInt8*       pFormelBuffer;  // -> memory.cxx, fuer
 extern CharSet      eCharVon;       // -> filter.cxx, character set specified
 
 static sal_uInt16       nDefWidth = ( sal_uInt16 ) ( TWIPS_PER_CHAR * 10 );
@@ -110,11 +103,14 @@ void OP_Integer( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nFormat >> nCol >> nRow >> nValue;
 
-    ScValueCell*    pZelle = new ScValueCell( ( double ) nValue );
-    pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        ScValueCell*	pZelle = new ScValueCell( ( double ) nValue );
+        pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
 
-    // 0 Stellen nach'm Komma!
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, 0 );
+        // 0 Stellen nach'm Komma!
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, 0 );
+    }
 }
 
 
@@ -127,11 +123,14 @@ void OP_Number( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nFormat >> nCol >> nRow >> fValue;
 
-    fValue = ::rtl::math::round( fValue, 15 );
-    ScValueCell*    pZelle = new ScValueCell( fValue );
-    pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        fValue = ::rtl::math::round( fValue, 15 );
+        ScValueCell*	pZelle = new ScValueCell( fValue );
+        pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
 
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+    }
 }
 
 
@@ -142,18 +141,22 @@ void OP_Label( SvStream& r, sal_uInt16 n )
     SCTAB           nTab = 0;
 
     r >> nFormat >> nCol >> nRow;
-    n -= 5;
 
-     sal_Char* pText = new sal_Char[n + 1];
-      r.Read( pText, n );
-     pText[n] = 0;
+    n -= (n > 5) ? 5 : n;
 
-    nFormat &= 0x80;    // Bit 7 belassen
-    nFormat |= 0x75;    // protected egal, special-text gesetzt
+    sal_Char* pText = new sal_Char[n + 1];
+    r.Read( pText, n );
+    pText[n] = 0;
+
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        nFormat &= 0x80;    // Bit 7 belassen
+        nFormat |= 0x75;    // protected egal, special-text gesetzt
 
-    PutFormString( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pText );
+        PutFormString( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pText );
 
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezStd );
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezStd );
+    }
 
     delete [] pText;
 }
@@ -176,14 +179,17 @@ void OP_Formula( SvStream& r, sal_uInt16 /*n*/ )
     aConv.Reset( aAddress );
     aConv.Convert( pErg, nBytesLeft );
 
-    ScFormulaCell*      pZelle = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        ScFormulaCell*		pZelle = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
 
-    pZelle->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
+        pZelle->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
 
-    pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
+        pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
 
-    // nFormat = Standard -> Nachkommastellen wie Float
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+        // nFormat = Standard -> Nachkommastellen wie Float
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+    }
 }
 
 
@@ -195,16 +201,19 @@ void OP_ColumnWidth( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nCol >> nWidthSpaces;
 
-    if( nWidthSpaces )
-        // Annahme: 10cpi-Zeichensatz
-        nBreite = ( sal_uInt16 ) ( TWIPS_PER_CHAR * nWidthSpaces );
-    else
+    if (ValidCol( static_cast<SCCOL>(nCol)))
     {
-        pDoc->SetColHidden(static_cast<SCCOL>(nCol), static_cast<SCCOL>(nCol), 0, true);
-        nBreite = nDefWidth;
-    }
+        if( nWidthSpaces )
+            // Annahme: 10cpi-Zeichensatz
+            nBreite = ( sal_uInt16 ) ( TWIPS_PER_CHAR * nWidthSpaces );
+        else
+        {
+            pDoc->SetColHidden(static_cast<SCCOL>(nCol), static_cast<SCCOL>(nCol), 0, true);
+            nBreite = nDefWidth;
+        }
 
-    pDoc->SetColWidth( static_cast<SCCOL> (nCol), nTab, nBreite );
+        pDoc->SetColWidth( static_cast<SCCOL> (nCol), nTab, nBreite );
+    }
 }
 
 
@@ -212,32 +221,38 @@ void OP_NamedRange( SvStream& r, sal_uInt16 /*n*/ )
     {
     // POST:    waren Koordinaten ungueltig, wird nicht gespeichert
     sal_uInt16              nColSt, nRowSt, nColEnd, nRowEnd;
-    sal_Char            cPuffer[ 32 ];
 
+    sal_Char cPuffer[ 16+1 ];
     r.Read( cPuffer, 16 );
+	cPuffer[ 16 ] = 0;
 
     r >> nColSt >> nRowSt >> nColEnd >> nRowEnd;
 
-    LotusRange*         pRange;
-
-    if( nColSt == nColEnd && nRowSt == nRowEnd )
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
-    else
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt), static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
-
-    if( isdigit( *cPuffer ) )
-    {   // erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
-        *pAnsi = 'A';
-        strcpy( pAnsi + 1, cPuffer );
-    }
-    else
-        strcpy( pAnsi, cPuffer );
+    if (ValidColRow( static_cast<SCCOL>(nColSt), nRowSt) && ValidColRow( static_cast<SCCOL>(nColEnd), nRowEnd))
+    {
+        LotusRange*			pRange;
+
+        if( nColSt == nColEnd && nRowSt == nRowEnd )
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
+        else
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt),
+                    static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
+
+        sal_Char cBuf[sizeof(cPuffer)+1];
+        if( isdigit( *cPuffer ) )
+        {	// erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
+            cBuf[0] = 'A';
+            strcpy( cBuf + 1, cPuffer );       // #100211# - checked
+        }
+        else
+            strcpy( cBuf, cPuffer );           // #100211# - checked
 
-    String              aTmp( pAnsi, pLotusRoot->eCharsetQ );
+        String				aTmp( cBuf, pLotusRoot->eCharsetQ );
 
-    ScfTools::ConvertToScDefinedName( aTmp );
+        ScfTools::ConvertToScDefinedName( aTmp );
 
-    pLotusRoot->pRangeNames->Append( pRange, aTmp );
+        pLotusRoot->pRangeNames->Append( pRange, aTmp );
+    }
 }
 
 
@@ -246,32 +261,37 @@ void OP_SymphNamedRange( SvStream& r, sal_uInt16 /*n*/ )
     // POST:    waren Koordinaten ungueltig, wird nicht gespeichert
     sal_uInt16              nColSt, nRowSt, nColEnd, nRowEnd;
     sal_uInt8               nType;
-    sal_Char            cPuffer[ 32 ];
 
+    sal_Char cPuffer[ 16+1 ];
     r.Read( cPuffer, 16 );
     cPuffer[ 16 ] = 0;
 
     r >> nColSt >> nRowSt >> nColEnd >> nRowEnd >> nType;
 
-    LotusRange*         pRange;
+    if (ValidColRow( static_cast<SCCOL>(nColSt), nRowSt) && ValidColRow( static_cast<SCCOL>(nColEnd), nRowEnd))
+    {
+        LotusRange*			pRange;
+
+        if( nType )
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
+        else
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt),
+                    static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
+
+        sal_Char cBuf[sizeof(cPuffer)+1];
+        if( isdigit( *cPuffer ) )
+        {	// erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
+            cBuf[0] = 'A';
+            strcpy( cBuf + 1, cPuffer );       // #100211# - checked
+        }
+        else
+            strcpy( cBuf, cPuffer );           // #100211# - checked
 
-    if( nType )
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
-    else
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt), static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
+        String		aTmp( cBuf, pLotusRoot->eCharsetQ );
+        ScfTools::ConvertToScDefinedName( aTmp );
 
-    if( isdigit( *cPuffer ) )
-    {   // erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
-        *pAnsi = 'A';
-        strcpy( pAnsi + 1, cPuffer );
+        pLotusRoot->pRangeNames->Append( pRange, aTmp );
     }
-    else
-        strcpy( pAnsi, cPuffer );
-
-    String      aTmp( pAnsi, pLotusRoot->eCharsetQ );
-    ScfTools::ConvertToScDefinedName( aTmp );
-
-    pLotusRoot->pRangeNames->Append( pRange, aTmp );
 }
 
 
@@ -361,7 +381,7 @@ void OP_Label123( SvStream& r, sal_uInt16 n )
     sal_uInt8      nTab, nCol;
     sal_uInt16    nRow;
     r >> nRow >> nTab >> nCol;
-    n -= 4;
+    n -= (n > 4) ? 4 : n;
 
     sal_Char* pText = new sal_Char[n + 1];
     r.Read( pText, n );
@@ -379,10 +399,14 @@ void OP_Number123( SvStream& r, sal_uInt16 /*n*/ )
     sal_uInt32   nValue;
 
     r >> nRow >> nTab >> nCol >> nValue;
-    double fValue = Snum32ToDouble( nValue );
 
-    ScValueCell *pCell = new ScValueCell( fValue );
-    pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow) && nTab < pDoc->GetMaxTableNumber())
+    {
+        double fValue = Snum32ToDouble( nValue );
+
+        ScValueCell *pCell = new ScValueCell( fValue );
+        pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    }
 }
 
 void OP_Formula123( SvStream& r, sal_uInt16 n )
@@ -394,18 +418,21 @@ void OP_Formula123( SvStream& r, sal_uInt16 n )
     r.SeekRel( 8 );    // Result- jump over
 
     const ScTokenArray* pErg;
-    sal_Int32               nBytesLeft = n - 12;
+    sal_Int32				nBytesLeft = (n > 12) ? n - 12 : 0;
     ScAddress           aAddress( nCol, nRow, nTab );
 
     LotusToSc           aConv( r, pLotusRoot->eCharsetQ, sal_True );
     aConv.Reset( aAddress );
     aConv.Convert( pErg, nBytesLeft );
 
-    ScFormulaCell*      pCell = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow) && nTab < pDoc->GetMaxTableNumber())
+    {
+        ScFormulaCell*		pCell = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
 
-    pCell->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
+        pCell->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
 
-    pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+        pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    }
 }
 
 void OP_IEEENumber123( SvStream& r, sal_uInt16 /*n*/ )
@@ -416,8 +443,11 @@ void OP_IEEENumber123( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nRow >> nTab >> nCol >> dValue;
 
-    ScValueCell *pCell = new ScValueCell(dValue);
-    pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow) && nTab < pDoc->GetMaxTableNumber())
+    {
+        ScValueCell *pCell = new ScValueCell(dValue);
+        pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    }
 }
 
 void OP_Note123( SvStream& r, sal_uInt16 n)
@@ -425,7 +455,7 @@ void OP_Note123( SvStream& r, sal_uInt16 n)
     sal_uInt8      nTab, nCol;
     sal_uInt16    nRow;
     r >> nRow >> nTab >> nCol;
-    n -= 4;
+    n -= (n > 4) ? 4 : n;
 
     sal_Char* pText = new sal_Char[n + 1];
     r.Read( pText, n );
@@ -508,7 +538,7 @@ void OP_CreatePattern123( SvStream& r, sal_uInt16 n)
     SfxItemSet& rItemSet = aPattern.GetItemSet();
 
     r >> nCode;
-    n = n - 2;
+    n -= (n > 2) ? 2 : n;
 
     if ( nCode == 0x0fd2 )
     {
@@ -543,7 +573,7 @@ void OP_CreatePattern123( SvStream& r, sal_uInt16 n)
         OP_VerAlign123( Ver_Align, rItemSet );
 
         aLotusPatternPool.insert( std::map<sal_uInt16, ScPatternAttr>::value_type( nPatternId, aPattern ) );
-        n = n - 20;
+        n -= (n > 20) ? 20 : n;
     }
     r.SeekRel(n);
 }
@@ -632,15 +662,13 @@ void OP_ApplyPatternArea123( SvStream& rStream )
                 {
                     rStream >> nData;
                     rStream.SeekRel( nLength - 2 );
-                    for( int i = 0; i < nTabCount; i++)
-                    {
-                        std::map<sal_uInt16, ScPatternAttr>::iterator loc = aLotusPatternPool.find( nData );
-
-                        // apparently, files with invalid index occur in the wild -> don't crash then
-                        OSL_ENSURE( loc != aLotusPatternPool.end(), "invalid format index" );
-                        if ( loc != aLotusPatternPool.end() )
+                    std::map<sal_uInt16, ScPatternAttr>::iterator loc = aLotusPatternPool.find( nData );
+                    // #126338# apparently, files with invalid index occur in the wild -> don't crash then
+                    if ( loc != aLotusPatternPool.end() )
+                        for( int i = 0; i < nTabCount; i++)
+                        {
                             pDoc->ApplyPatternAreaTab( nCol, nRow, nCol +  nColCount - 1, nRow + nRowCount - 1, static_cast< SCTAB >( nTab + i ), loc->second );
-                    }
+                        }
                 }
                 else
                     rStream.SeekRel( nLength );
diff --git a/sc/source/filter/lotus/tool.cxx b/sc/source/filter/lotus/tool.cxx
index d36abf671822..4c2d96814d42 100644
--- a/sc/source/filter/lotus/tool.cxx
+++ b/sc/source/filter/lotus/tool.cxx
@@ -56,11 +56,7 @@
 
 //--------------------------------------------------------- EXTERNE VARIABLEN -
 extern WKTYP                eTyp;           // -> filter.cxx, aktueller Dateityp
-extern sal_Char*            pDummy2;        // -> memory.cxx
 extern ScDocument*          pDoc;           // -> filter.cxx, Aufhaenger zum Dokumentzugriff
-extern CharSet              eCharNach;      // -> filter.cxx, Zeichenkonvertierung von->nach
-
-extern sal_Bool                 bFormInit;      // -> memory.cxx, fuer GetFormHandle()
 
 //--------------------------------------------------------- GLOBALE VARIABLEN -
 sal_uInt8                       nDefaultFormat; // -> op.cpp, Standard-Zellenformat
@@ -86,6 +82,8 @@ void PutFormString( SCCOL nCol, SCROW nRow, SCTAB nTab, sal_Char* pString )
 {
     // Label-Format-Auswertung
     OSL_ENSURE( pString != NULL, "PutFormString(): pString == NULL" );
+    if (!pString)
+        return;
 
     sal_Char            cForm;
     SvxHorJustifyItem*  pJustify = NULL;
@@ -117,12 +115,9 @@ void PutFormString( SCCOL nCol, SCROW nRow, SCTAB nTab, sal_Char* pString )
             pJustify = pAttrStandard;
     }
 
-    if( pString )
-    {
-        pDoc->ApplyAttr( nCol, nRow, nTab, *pJustify );
-        ScStringCell*   pZelle = new ScStringCell( String( pString, pLotusRoot->eCharsetQ ) );
-        pDoc->PutCell( nCol, nRow, nTab, pZelle, true );
-    }
+    pDoc->ApplyAttr( nCol, nRow, nTab, *pJustify );
+    ScStringCell*	pZelle = new ScStringCell( String( pString, pLotusRoot->eCharsetQ ) );
+    pDoc->PutCell( nCol, nRow, nTab, pZelle, true );
 }