diff options
| author | Eike Rathke <erack@redhat.com> | 2017-12-01 10:54:01 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-02-02 22:49:40 +0100 |
| commit | 6e2f927704980c0057d5deb3a6bc3ef5540379a4 (patch) | |
| tree | 370662844e248a647af9ae44e4d0109e9f4ba853 /sc/source/filter/lotus | |
| parent | 5b51f45bcbf5fb70b7e53d9deaf5663402f61b27 (diff) | |
ofz: guard against binary crap argument counts and ID/OpCode generation
This is a combination of 2 commits.
ofz: guard against binary crap argument counts and ID/OpCode generation
(cherry picked from commit 889c72a7e54f241342f42b1b0a05858902228cbc)
Do not force non-existent parameters into the TokenPool, ofz-related
(cherry picked from commit e6ced1496da9580cf885cce1a2fc9f67528c3a0e)
2fa0ae81b987af592c14486040077c9ff157fab9
Change-Id: I60e181729713f3b202e880707a79e9da80d9d85d
Reviewed-on: https://gerrit.libreoffice.org/49161
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sc/source/filter/lotus')
| -rw-r--r-- | sc/source/filter/lotus/lotform.cxx | 27 |
1 files changed, 21 insertions, 6 deletions
diff --git a/sc/source/filter/lotus/lotform.cxx b/sc/source/filter/lotus/lotform.cxx index 068a77f5bb46..091da56e9dbb 100644 --- a/sc/source/filter/lotus/lotform.cxx +++ b/sc/source/filter/lotus/lotform.cxx @@ -77,9 +77,13 @@ void LotusToSc::DoFunc( DefTokenId eOc, sal_uInt8 nCnt, const sal_Char* pExtStri } } - for( nLauf = 0 ; nLauf < nCnt ; nLauf++ ) + for( nLauf = 0 ; nLauf < nCnt && aStack.HasMoreTokens() ; nLauf++ ) aStack >> eParam[ nLauf ]; + if (nLauf < nCnt) + // Adapt count to reality. All sort of binary crap is possible. + nCnt = static_cast<sal_uInt8>(nLauf); + // special cases... switch( eOc ) { @@ -189,12 +193,23 @@ void LotusToSc::DoFunc( DefTokenId eOc, sal_uInt8 nCnt, const sal_Char* pExtStri sal_Int16 nLast = nCnt - 1; if( eOc == ocPMT ) - { // special case ocPMT, ignore (negate?) last parameter! + { // special case ocPMT, negate last parameter! // additionally: 1. -> 3., 3. -> 2., 2. -> 1. - SAL_WARN_IF( nCnt != 3, "sc", - "+LotusToSc::DoFunc(): ocPMT needs 3 parameters!" ); - aPool << eParam[ 1 ] << ocSep << eParam[ 0 ] << ocSep - << ocNegSub << eParam[ 2 ]; + SAL_WARN_IF( nCnt != 3, "sc", "+LotusToSc::DoFunc(): ocPMT needs 3 parameters!" ); + // There should be at least 3 arguments, but with binary crap may not.. + switch (nCnt) + { + case 1: + aPool << eParam[ 1 ]; + break; + case 2: + aPool << eParam[ 1 ] << ocSep << eParam[ 0 ]; + break; + default: + case 3: + aPool << eParam[ 1 ] << ocSep << eParam[ 0 ] << ocSep << ocNegSub << eParam[ 2 ]; + break; + } } else { // default |