Lotus WK: fix warnings

8 files changed, 216 insertions, 248 deletions

diff --git a/sc/source/filter/lotus/filter.cxx b/sc/source/filter/lotus/filter.cxx
index 96a97ffa2560..cd783516bcd1 100644
--- a/sc/source/filter/lotus/filter.cxx
+++ b/sc/source/filter/lotus/filter.cxx
@@ -63,9 +63,6 @@ WKTYP               eTyp;
 extern sal_Bool         bEOF;           // zeigt Ende der Datei
 sal_Bool                bEOF;
 
-extern CharSet      eCharNach;      // Zeichenkonvertierung von->nach
-CharSet             eCharNach;
-
 extern CharSet      eCharVon;
 CharSet             eCharVon;
 
@@ -73,16 +70,11 @@ extern ScDocument*  pDoc;           // Aufhaenger zum Dokumentzugriff
 ScDocument*         pDoc;
 
 
-extern sal_Char*    pPuffer;        // -> memory.cxx
-extern sal_Char*    pDummy1;        // -> memory.cxx
-
 extern OPCODE_FKT   pOpFkt[ FKT_LIMIT ];
                                     // -> optab.cxx, Tabelle moeglicher Opcodes
 extern OPCODE_FKT   pOpFkt123[ FKT_LIMIT123 ];
                                     // -> optab.cxx, Table of possible Opcodes
 
-extern long         nDateiLaenge;   // -> datei.cpp, ...der gerade offenen Datei
-
 LOTUS_ROOT*         pLotusRoot = NULL;
 
 
@@ -196,9 +188,10 @@ WKTYP ScanVersion( SvStream& aStream )
             aStream >> nVersNr;
             if( aStream.IsEof() ) return eWK_Error;
             if( nVersNr == 0x0004 && nRecLen == 26 )
-            {   // 4 Bytes von 26 gelesen->22 ueberlesen
-                aStream.Read( pDummy1, 22 );
-                return eWK3;
+			{	// 4 bytes of 26 read => skip 22 (read instead of seek to make IsEof() work just in case)
+                sal_Char aDummy[22];
+                aStream.Read( aDummy, 22 );
+                return aStream.IsEof() ? eWK_Error : eWK3;
             }
             break;
         case 0x1003:
diff --git a/sc/source/filter/lotus/lotattr.cxx b/sc/source/filter/lotus/lotattr.cxx
index e21e84778278..7f5f3ab2447c 100644
--- a/sc/source/filter/lotus/lotattr.cxx
+++ b/sc/source/filter/lotus/lotattr.cxx
@@ -187,7 +187,7 @@ void LotAttrCache::LotusToScBorderLine( sal_uInt8 nLine, ::editeng::SvxBorderLin
 const SvxColorItem& LotAttrCache::GetColorItem( const sal_uInt8 nLotIndex ) const
 {
     OSL_ENSURE( nLotIndex > 0 && nLotIndex < 7,
-        "-LotAttrCache::GetColorItem(): so nicht!" );
+		"-LotAttrCache::GetColorItem(): caller hast to check index!" );
 
     return *ppColorItems[ nLotIndex - 1 ];
 }
@@ -195,13 +195,15 @@ const SvxColorItem& LotAttrCache::GetColorItem( const sal_uInt8 nLotIndex ) cons
 const Color& LotAttrCache::GetColor( const sal_uInt8 nLotIndex ) const
 {
     // Farbe <-> Index passt fuer Background, nicht aber fuer Fonts (0 <-> 7)!
-    OSL_ENSURE( nLotIndex < 8, "*LotAttrCache::GetColor(): Index > 7!" );
+	OSL_ENSURE( nLotIndex < 8, "*LotAttrCache::GetColor(): Index > 7, caller hast to check index!" );
 
     return pColTab[ nLotIndex ];
 }
 
 void LotAttrCol::SetAttr( const SCROW nRow, const ScPatternAttr& rAttr )
 {
+    // Actually with the current implementation of MAXROWCOUNT>=64k and nRow
+    // being read as sal_uInt16 there's no chance that nRow would be invalid..
     OSL_ENSURE( ValidRow(nRow), "*LotAttrCol::SetAttr(): ... und rums?!" );
 
     boost::ptr_vector<ENTRY>::reverse_iterator iterLast = aEntries.rbegin();
@@ -246,6 +248,9 @@ void LotAttrCol::Apply( const SCCOL nColNum, const SCTAB nTabNum )
 void LotAttrTable::SetAttr( const SCCOL nColFirst, const SCCOL nColLast, const SCROW nRow,
                             const LotAttrWK3& rAttr )
 {
+    // With the current implementation of MAXCOLCOUNT>=1024 and nColFirst and
+    // nColLast being calculated as sal_uInt8+sal_uInt8 there's no chance that
+    // they would be invalid.
     const ScPatternAttr &rPattAttr = aAttrCache.GetPattAttr( rAttr );
     SCCOL nColCnt;
 
diff --git a/sc/source/filter/lotus/lotform.cxx b/sc/source/filter/lotus/lotform.cxx
index 6fbd929bed0f..c67b50accbbc 100644
--- a/sc/source/filter/lotus/lotform.cxx
+++ b/sc/source/filter/lotus/lotform.cxx
@@ -120,7 +120,8 @@ void LotusToSc::DoFunc( DefTokenId eOc, sal_uInt8 nAnz, const sal_Char* pExtStri
             break;
         case ocChose:
         {// 1. Parameter ++
-            IncToken( eParam[ nAnz - 1 ] );
+            if (nAnz >= 1)
+                IncToken( eParam[ nAnz - 1 ] );
         }
             break;
         case ocFind:
@@ -133,7 +134,8 @@ void LotusToSc::DoFunc( DefTokenId eOc, sal_uInt8 nAnz, const sal_Char* pExtStri
         case ocMid:
         case ocReplace:
         {// 2. Parameter ++
-            IncToken( eParam[ nAnz - 2 ] );
+            if (nAnz >= 2)
+                IncToken( eParam[ nAnz - 2 ] );
         }
             break;
         case ocZins:
@@ -602,14 +604,18 @@ ConvErr LotusToSc::Convert( const ScTokenArray*& rpErg, sal_Int32& rRest,
 
                 if( nStrLen )
                 {
-//                  String  t( ReadString( aIn, nStrLen, eSrcChar ) );
-                    sal_Char*   p = new sal_Char[ nStrLen + 1 ];
-                    aIn.Read( p, nStrLen );
-                    p[ nStrLen ] = 0x00;
+					sal_Char*	p = new (::std::nothrow) sal_Char[ nStrLen + 1 ];
+                    if (p)
+                    {
+                        aIn.Read( p, nStrLen );
+                        p[ nStrLen ] = 0x00;
 
-                    DoFunc( ocNoName, nAnz, p );
+                        DoFunc( ocNoName, nAnz, p );
 
-                    delete[] p;
+                        delete[] p;
+                    }
+                    else
+                        DoFunc( ocNoName, nAnz, NULL );
                 }
                 else
                     DoFunc( ocNoName, nAnz, NULL );
@@ -1989,7 +1995,7 @@ const sal_Char* GetAddInName( const sal_uInt8 n )
 }
 
 
-DefTokenId lcl_KnownAddIn( const rtl::OString& rTest )
+static DefTokenId lcl_KnownAddIn( const rtl::OString& rTest )
 {
     DefTokenId  eId = ocNoName;
 
diff --git a/sc/source/filter/lotus/lotimpop.cxx b/sc/source/filter/lotus/lotimpop.cxx
index 46c38b6193ea..4eda7c531892 100644
--- a/sc/source/filter/lotus/lotimpop.cxx
+++ b/sc/source/filter/lotus/lotimpop.cxx
@@ -46,6 +46,29 @@
 #include "lotrange.hxx"
 #include "lotattr.hxx"
 
+LOTUS_ROOT::LOTUS_ROOT( ScDocument* pDocP, CharSet eQ )
+    :
+        pDoc( pDocP),
+        pRangeNames( new LotusRangeList),
+        pScRangeName( pDocP->GetRangeName()),
+        eCharsetQ( eQ),
+        eFirstType( Lotus_X),
+        eActType( Lotus_X),
+        pRngNmBffWK3( new RangeNameBufferWK3),
+        pFontBuff( new LotusFontBuffer),
+        pAttrTable( new LotAttrTable)
+{
+}
+
+
+LOTUS_ROOT::~LOTUS_ROOT()
+{
+	delete pRangeNames;
+	delete pRngNmBffWK3;
+	delete pFontBuff;
+	delete pAttrTable;
+}
+
 
 static osl::Mutex aLotImpSemaphore;
 
@@ -58,30 +81,14 @@ ImportLotus::ImportLotus( SvStream& aStream, ScDocument* pDoc, CharSet eQ ) :
     // good point to start locking of import lotus
     aLotImpSemaphore.acquire();
 
-    pLotusRoot = new LOTUS_ROOT;
-    pLotusRoot->pDoc = pDoc;
-    pLotusRoot->pRangeNames = new LotusRangeList;
-    pLotusRoot->pScRangeName = pDoc->GetRangeName();
-    pLotusRoot->eCharsetQ = eQ;
-    pLotusRoot->eFirstType = Lotus_X;
-    pLotusRoot->eActType = Lotus_X;
-    pLotusRoot->pRngNmBffWK3 = new RangeNameBufferWK3;
-    pFontBuff = pLotusRoot->pFontBuff = new LotusFontBuffer;
-    pLotusRoot->pAttrTable = new LotAttrTable;
+	pLotusRoot = new LOTUS_ROOT( pDoc, eQ);
 }
 
 
 ImportLotus::~ImportLotus()
 {
-    delete pLotusRoot->pRangeNames;
-    delete pLotusRoot->pRngNmBffWK3;
-    delete pFontBuff;
-    delete pLotusRoot->pAttrTable;
     delete pLotusRoot;
-
-#if OSL_DEBUG_LEVEL > 0
     pLotusRoot = NULL;
-#endif
 
     // no need 4 pLotusRoot anymore
     aLotImpSemaphore.release();
@@ -132,7 +139,7 @@ void ImportLotus::Columnwidth( sal_uInt16 nRecLen )
     OSL_ENSURE( nRecLen >= 4, "*ImportLotus::Columnwidth(): Record zu kurz!" );
 
     sal_uInt8    nLTab, nWindow2;
-    sal_uInt16  nCnt = ( nRecLen - 4 ) / 2;
+	sal_uInt16	nCnt = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 2;
 
     Read( nLTab );
     Read( nWindow2 );
@@ -164,7 +171,7 @@ void ImportLotus::Hiddencolumn( sal_uInt16 nRecLen )
     OSL_ENSURE( nRecLen >= 4, "*ImportLotus::Hiddencolumn(): Record zu kurz!" );
 
     sal_uInt8    nLTab, nWindow2;
-    sal_uInt16  nCnt = ( nRecLen - 4 ) / 2;
+	sal_uInt16	nCnt = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 2;
 
     Read( nLTab );
     Read( nWindow2 );
@@ -190,18 +197,17 @@ void ImportLotus::Userrange( void )
 {
     sal_uInt16      nRangeType;
     ScRange     aScRange;
-    sal_Char*   pBuffer = new sal_Char[ 32 ];
 
     Read( nRangeType );
 
-    pIn->Read( pBuffer, 16 );
-    pBuffer[ 16 ] = ( sal_Char ) 0x00;  // zur Sicherheit...
-    String      aName( pBuffer, eQuellChar );
+	sal_Char aBuffer[ 17 ];
+	pIn->Read( aBuffer, 16 );
+	aBuffer[ 16 ] = 0;
+	String		aName( aBuffer, eQuellChar );
 
     Read( aScRange );
 
     pLotusRoot->pRngNmBffWK3->Add( aName, aScRange );
-    delete[] pBuffer;
 }
 
 
@@ -242,7 +248,7 @@ void ImportLotus::Labelcell( void )
 
 
 void ImportLotus::Numbercell( void )
-    {
+{
     ScAddress   aAddr;
     double      fVal;
 
@@ -276,7 +282,7 @@ ScFormulaCell *ImportLotus::Formulacell( sal_uInt16 n )
     Read( aAddr );
     Skip( 10 );
 
-    n -= 14;
+	n -= (n > 14) ? 14 : n;
 
     const ScTokenArray* pErg;
     sal_Int32               nRest = n;
@@ -292,7 +298,7 @@ ScFormulaCell *ImportLotus::Formulacell( sal_uInt16 n )
     pD->PutCell( aAddr.Col(), aAddr.Row(), aAddr.Tab(), pZelle, true );
 
     return NULL;
-    }
+}
 
 
 void ImportLotus::Read( String &r )
@@ -307,7 +313,7 @@ void ImportLotus::RowPresentation( sal_uInt16 nRecLen )
 
     sal_uInt8    nLTab, nFlags;
     sal_uInt16  nRow, nHeight;
-    sal_uInt16  nCnt = ( nRecLen - 4 ) / 8;
+	sal_uInt16	nCnt = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 8;
 
     Read( nLTab );
     Skip( 1 );
@@ -358,52 +364,44 @@ void ImportLotus::Font_Face( void )
 
     Read( nNum );
 
-    // ACHTUNG: QUICK-HACK gegen unerklaerliche Loops
-    if( nNum > 7 )
-        return;
-    // ACHTUNG
+	if( nNum >= LotusFontBuffer::nSize )
+		return;     // nonsense
 
     Read( aName );
 
-    pFontBuff->SetName( nNum, aName );
+	pLotusRoot->pFontBuff->SetName( nNum, aName );
 }
 
 
 void ImportLotus::Font_Type( void )
 {
-    static const sal_uInt16 nAnz = 8;
-    sal_uInt16              nCnt;
-    sal_uInt16              nType;
-
-    for( nCnt = 0 ; nCnt < nAnz ; nCnt++ )
+	for( sal_uInt16 nCnt = 0 ; nCnt < LotusFontBuffer::nSize ; nCnt++ )
     {
+        sal_uInt16 nType;
         Read( nType );
-        pFontBuff->SetType( nCnt, nType );
+		pLotusRoot->pFontBuff->SetType( nCnt, nType );
     }
 }
 
 
 void ImportLotus::Font_Ysize( void )
 {
-    static const sal_uInt16 nAnz = 8;
-    sal_uInt16              nCnt;
-    sal_uInt16              nSize;
-
-    for( nCnt = 0 ; nCnt < nAnz ; nCnt++ )
+	for( sal_uInt16 nCnt = 0 ; nCnt < LotusFontBuffer::nSize ; nCnt++ )
     {
+        sal_uInt16 nSize;
         Read( nSize );
-        pFontBuff->SetHeight( nCnt, nSize );
+		pLotusRoot->pFontBuff->SetHeight( nCnt, nSize );
     }
 }
 
 
 void ImportLotus::_Row( const sal_uInt16 nRecLen )
-    {
+{
     OSL_ENSURE( nExtTab >= 0, "*ImportLotus::_Row(): Kann hier nicht sein!" );
 
     sal_uInt16          nRow;
     sal_uInt16          nHeight;
-    sal_uInt16          nCntDwn = ( nRecLen - 4 ) / 5;
+	sal_uInt16			nCntDwn = (nRecLen < 4) ? 0 : ( nRecLen - 4 ) / 5;
     SCCOL           nColCnt = 0;
     sal_uInt8           nRepeats;
     LotAttrWK3      aAttr;
@@ -467,7 +465,5 @@ void ImportLotus::_Row( const sal_uInt16 nRecLen )
     if( bCenter )
         // evtl. alte Center bemachen
         pD->DoMerge( static_cast<SCTAB> (nExtTab), nCenterStart, static_cast<SCROW> (nRow), nCenterEnd, static_cast<SCROW> (nRow) );
-    }
-
-
+}
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sc/source/filter/lotus/lotread.cxx b/sc/source/filter/lotus/lotread.cxx
index ab302fd17652..35b7fc670ba5 100644
--- a/sc/source/filter/lotus/lotread.cxx
+++ b/sc/source/filter/lotus/lotread.cxx
@@ -71,7 +71,7 @@ FltError ImportLotus::Read()
     {
         *pIn >> nOp >> nRecLen;
 
-        if( pIn->IsEof() )
+		if( pIn->IsEof() || nNextRec > SAL_MAX_UINT32 - nRecLen - 4 )
             eAkt = S_END;
 
         nNextRec += nRecLen + 4;
@@ -166,17 +166,25 @@ FltError ImportLotus::Read()
                 break;
 
                 case 0x001b:                            // extended attributes
-                Read( nSubType );
-                nRecLen -= 2;
-                switch( nSubType )
+                if (nRecLen > 2)
                 {
-                    case 2007:                              // ROW PRESENTATION
-                    RowPresentation( nRecLen );
-                    break;
+                    Read( nSubType );
+                    nRecLen -= 2;
+                    switch( nSubType )
+                    {
+                        case 2007:                      // ROW PRESENTATION
+                            RowPresentation( nRecLen );
+                            break;
 
-                    case 14000:                             // NAMED SHEET
-                    NamedSheet();
-                    break;
+                        case 14000:                     // NAMED SHEET
+                            NamedSheet();
+                            break;
+                    }
+                }
+                else
+                {
+                    eRet = eERR_FORMAT;
+                    eAkt = S_END;
                 }
             }
 
@@ -187,12 +195,6 @@ FltError ImportLotus::Read()
             // -----------------------------------------------------------
             case S_END:                                             // S_END
             break;
-            // -----------------------------------------------------------
-#if OSL_DEBUG_LEVEL > 0
-            default:
-            OSL_FAIL( "*ImportLotus::Read(): State unbekannt!" );
-            eAkt = S_END;
-#endif
         }
 
         OSL_ENSURE( nNextRec >= pIn->Tell(),
@@ -257,7 +259,7 @@ FltError ImportLotus::Read( SvStream& rIn )
     {
         *pIn >> nOp >> nRecLen;
 
-        if( pIn->IsEof() )
+		if( pIn->IsEof() || nNextRec > SAL_MAX_UINT32 - nRecLen - 4 )
             bRead = false;
         else
         {
diff --git a/sc/source/filter/lotus/memory.cxx b/sc/source/filter/lotus/memory.cxx
index 5287afe625d3..3bfddfefee6d 100644
--- a/sc/source/filter/lotus/memory.cxx
+++ b/sc/source/filter/lotus/memory.cxx
@@ -32,38 +32,10 @@
 #include "decl.h"
 #include "tool.h"
 
-extern const long       nStackSize;
-extern const int        nAnzNRange;
-
 extern ScDocument*      pDoc;
 
-const long              nStackSize = 8L * 1024;     // -> form_xxx.cpp
-const int               nAnzNRange = 2048;          // -> tool_xxx.cpp, max. 2048 Named Ranges
-
-sal_Char*               pPuffer;                    // -> flt_xxx.cxx
-sal_Char*               pDummy1;                    // -> flt_xxx.cxx, ScanVersion()
-sal_Char*               pDummy2;                    // -> tool.cxx, CreateTable()
-
-extern sal_uInt8*           pFormelBuffer;              // -> tool.cxx, fuer OP_Formula()
-sal_uInt8*                  pFormelBuffer;
-
 extern FormCache*       pValueFormCache;            // -> tool.cxx
 
-sal_Char*               pStack;                     // -> formel.cxx
-sal_Char*               pPuffer0;                   // -> formel.cxx
-sal_Char*               pPuffer1;                   // -> formel.cxx
-extern const int        nMaxPar;
-const int               nMaxPar = 128;              // max. 128 Parameter werden unterstuetzt
-sal_Char**              pPar;                       // -> formel.cxx, Pn()
-
-#ifndef _DOS                                        // -> op.cxx
-sal_Char*               pAnsi;
-#endif
-sal_Char*               pErgebnis;                  // -> op.cxx
-
-extern sal_Bool             bFormInit;                  // -> tool.cxx, fuer GetFormHandle()
-sal_Bool                    bFormInit;
-
 extern SvxHorJustifyItem    *pAttrRight, *pAttrLeft, *pAttrCenter,
                             *pAttrRepeat, *pAttrStandard;   // -> tool.cxx, fuer GetFormAttr()
 extern ScProtectionAttr*    pAttrUnprot;   // -> tool.cxx, fuer PutFormString()
@@ -72,25 +44,6 @@ extern ScProtectionAttr*    pAttrUnprot;   // -> tool.cxx, fuer PutFormString()
 
 sal_Bool MemNew( void )
 {
-    pPuffer = new sal_Char [ 32L*1024L ];
-
-    pDummy1 = new sal_Char [ 32 ];
-
-    pDummy2 = new sal_Char [ 32 ];
-
-    pStack = new sal_Char [ nStackSize * 3 ];   // alle drei auf einmal
-
-    pPuffer0 = pStack + nStackSize;
-    pPuffer1 = pPuffer0 + nStackSize;
-
-    pAnsi = new sal_Char [ 2048 ];
-
-    pErgebnis = new sal_Char [ 32L*1024L ];
-
-    pPar = new sal_Char *[ nMaxPar ];
-
-    pFormelBuffer = new sal_uInt8[ 4096 ];
-
     pValueFormCache = new FormCache( pDoc );
 
     // fuer tool.cxx::PutFormString()
@@ -100,7 +53,6 @@ sal_Bool MemNew( void )
     pAttrCenter = new SvxHorJustifyItem( SVX_HOR_JUSTIFY_CENTER, ATTR_HOR_JUSTIFY );
     pAttrRepeat = new SvxHorJustifyItem( SVX_HOR_JUSTIFY_REPEAT, ATTR_HOR_JUSTIFY );
     pAttrStandard = new SvxHorJustifyItem( SVX_HOR_JUSTIFY_STANDARD, ATTR_HOR_JUSTIFY );
-    bFormInit = sal_True;
 
     return sal_True;
 }
@@ -108,15 +60,6 @@ sal_Bool MemNew( void )
 
 void MemDelete( void )
 {
-    delete[] pPuffer;
-    delete[] pDummy1;
-    delete[] pDummy2;
-    delete[] pStack;
-    delete[] pAnsi;
-    delete[] pErgebnis;
-    delete[] pPar;
-    delete[] pFormelBuffer;
-
     delete pValueFormCache;
     delete pAttrRight;
     delete pAttrLeft;
diff --git a/sc/source/filter/lotus/op.cxx b/sc/source/filter/lotus/op.cxx
index ccc8fcbb063b..4bda976488fa 100644
--- a/sc/source/filter/lotus/op.cxx
+++ b/sc/source/filter/lotus/op.cxx
@@ -33,9 +33,7 @@
 #include <string.h>
 #include <math.h>
 #include <ctype.h>
-#if defined( ICC )
 #include <stdlib.h>
-#endif
 
 #include "scitems.hxx"
 #include "patattr.hxx"
@@ -65,15 +63,10 @@
 #include <vector>
 #include <map>
 
-extern sal_Char*    pAnsi;          // -> memory.cxx, Puffer zum Umwandeln von OEM->ANSI
-extern sal_Char*    pErgebnis;      // -> memory.cxx, Ergebnispuffer
 extern WKTYP        eTyp;           // -> filter.cxx, aktueller Dateityp
 extern sal_Bool         bEOF;           // -> filter.cxx, zeigt Dateiende an
-extern sal_Char*    pPuffer0;       // -> memory.cxx
-extern sal_Char*    pPuffer1;
 extern sal_uInt8            nDefaultFormat; // -> tool.cxx, Default-Zellenformat
 extern ScDocument*  pDoc;           // -> filter.cxx, Aufhaenger zum Dokumentzugriff
-extern sal_uInt8*       pFormelBuffer;  // -> memory.cxx, fuer
 extern CharSet      eCharVon;       // -> filter.cxx, character set specified
 
 static sal_uInt16       nDefWidth = ( sal_uInt16 ) ( TWIPS_PER_CHAR * 10 );
@@ -107,11 +100,14 @@ void OP_Integer( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nFormat >> nCol >> nRow >> nValue;
 
-    ScValueCell*    pZelle = new ScValueCell( ( double ) nValue );
-    pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        ScValueCell*	pZelle = new ScValueCell( ( double ) nValue );
+        pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
 
-    // 0 Stellen nach'm Komma!
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, 0 );
+        // 0 Stellen nach'm Komma!
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, 0 );
+    }
 }
 
 
@@ -124,11 +120,14 @@ void OP_Number( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nFormat >> nCol >> nRow >> fValue;
 
-    fValue = ::rtl::math::round( fValue, 15 );
-    ScValueCell*    pZelle = new ScValueCell( fValue );
-    pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        fValue = ::rtl::math::round( fValue, 15 );
+        ScValueCell*	pZelle = new ScValueCell( fValue );
+        pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
 
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+    }
 }
 
 
@@ -139,18 +138,22 @@ void OP_Label( SvStream& r, sal_uInt16 n )
     SCTAB           nTab = 0;
 
     r >> nFormat >> nCol >> nRow;
-    n -= 5;
 
-     sal_Char* pText = new sal_Char[n + 1];
-      r.Read( pText, n );
-     pText[n] = 0;
+    n -= (n > 5) ? 5 : n;
 
-    nFormat &= 0x80;    // Bit 7 belassen
-    nFormat |= 0x75;    // protected egal, special-text gesetzt
+    sal_Char* pText = new sal_Char[n + 1];
+    r.Read( pText, n );
+    pText[n] = 0;
+
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        nFormat &= 0x80;    // Bit 7 belassen
+        nFormat |= 0x75;    // protected egal, special-text gesetzt
 
-    PutFormString( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pText );
+        PutFormString( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pText );
 
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezStd );
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezStd );
+    }
 
     delete [] pText;
 }
@@ -173,14 +176,17 @@ void OP_Formula( SvStream& r, sal_uInt16 /*n*/ )
     aConv.Reset( aAddress );
     aConv.Convert( pErg, nBytesLeft );
 
-    ScFormulaCell*      pZelle = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow))
+    {
+        ScFormulaCell*		pZelle = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
 
-    pZelle->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
+        pZelle->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
 
-    pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
+        pDoc->PutCell( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, pZelle, true );
 
-    // nFormat = Standard -> Nachkommastellen wie Float
-    SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+        // nFormat = Standard -> Nachkommastellen wie Float
+        SetFormat( static_cast<SCCOL> (nCol), static_cast<SCROW> (nRow), nTab, nFormat, nDezFloat );
+    }
 }
 
 
@@ -192,16 +198,19 @@ void OP_ColumnWidth( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nCol >> nWidthSpaces;
 
-    if( nWidthSpaces )
-        // Annahme: 10cpi-Zeichensatz
-        nBreite = ( sal_uInt16 ) ( TWIPS_PER_CHAR * nWidthSpaces );
-    else
+    if (ValidCol( static_cast<SCCOL>(nCol)))
     {
-        pDoc->SetColHidden(static_cast<SCCOL>(nCol), static_cast<SCCOL>(nCol), 0, true);
-        nBreite = nDefWidth;
-    }
+        if( nWidthSpaces )
+            // Annahme: 10cpi-Zeichensatz
+            nBreite = ( sal_uInt16 ) ( TWIPS_PER_CHAR * nWidthSpaces );
+        else
+        {
+            pDoc->SetColHidden(static_cast<SCCOL>(nCol), static_cast<SCCOL>(nCol), 0, true);
+            nBreite = nDefWidth;
+        }
 
-    pDoc->SetColWidth( static_cast<SCCOL> (nCol), nTab, nBreite );
+        pDoc->SetColWidth( static_cast<SCCOL> (nCol), nTab, nBreite );
+    }
 }
 
 
@@ -209,32 +218,38 @@ void OP_NamedRange( SvStream& r, sal_uInt16 /*n*/ )
     {
     // POST:    waren Koordinaten ungueltig, wird nicht gespeichert
     sal_uInt16              nColSt, nRowSt, nColEnd, nRowEnd;
-    sal_Char            cPuffer[ 32 ];
 
+    sal_Char cPuffer[ 16+1 ];
     r.Read( cPuffer, 16 );
+	cPuffer[ 16 ] = 0;
 
     r >> nColSt >> nRowSt >> nColEnd >> nRowEnd;
 
-    LotusRange*         pRange;
-
-    if( nColSt == nColEnd && nRowSt == nRowEnd )
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
-    else
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt), static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
-
-    if( isdigit( *cPuffer ) )
-    {   // erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
-        *pAnsi = 'A';
-        strcpy( pAnsi + 1, cPuffer );
-    }
-    else
-        strcpy( pAnsi, cPuffer );
+    if (ValidColRow( static_cast<SCCOL>(nColSt), nRowSt) && ValidColRow( static_cast<SCCOL>(nColEnd), nRowEnd))
+    {
+        LotusRange*			pRange;
+
+        if( nColSt == nColEnd && nRowSt == nRowEnd )
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
+        else
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt),
+                    static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
+
+        sal_Char cBuf[sizeof(cPuffer)+1];
+        if( isdigit( *cPuffer ) )
+        {	// erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
+            cBuf[0] = 'A';
+            strcpy( cBuf + 1, cPuffer );       // #100211# - checked
+        }
+        else
+            strcpy( cBuf, cPuffer );           // #100211# - checked
 
-    String              aTmp( pAnsi, pLotusRoot->eCharsetQ );
+        String				aTmp( cBuf, pLotusRoot->eCharsetQ );
 
-    ScfTools::ConvertToScDefinedName( aTmp );
+        ScfTools::ConvertToScDefinedName( aTmp );
 
-    pLotusRoot->pRangeNames->Append( pRange, aTmp );
+        pLotusRoot->pRangeNames->Append( pRange, aTmp );
+    }
 }
 
 
@@ -243,32 +258,37 @@ void OP_SymphNamedRange( SvStream& r, sal_uInt16 /*n*/ )
     // POST:    waren Koordinaten ungueltig, wird nicht gespeichert
     sal_uInt16              nColSt, nRowSt, nColEnd, nRowEnd;
     sal_uInt8               nType;
-    sal_Char            cPuffer[ 32 ];
 
+    sal_Char cPuffer[ 16+1 ];
     r.Read( cPuffer, 16 );
     cPuffer[ 16 ] = 0;
 
     r >> nColSt >> nRowSt >> nColEnd >> nRowEnd >> nType;
 
-    LotusRange*         pRange;
+    if (ValidColRow( static_cast<SCCOL>(nColSt), nRowSt) && ValidColRow( static_cast<SCCOL>(nColEnd), nRowEnd))
+    {
+        LotusRange*			pRange;
+
+        if( nType )
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
+        else
+            pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt),
+                    static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
+
+        sal_Char cBuf[sizeof(cPuffer)+1];
+        if( isdigit( *cPuffer ) )
+        {	// erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
+            cBuf[0] = 'A';
+            strcpy( cBuf + 1, cPuffer );       // #100211# - checked
+        }
+        else
+            strcpy( cBuf, cPuffer );           // #100211# - checked
 
-    if( nType )
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt) );
-    else
-        pRange = new LotusRange( static_cast<SCCOL> (nColSt), static_cast<SCROW> (nRowSt), static_cast<SCCOL> (nColEnd), static_cast<SCROW> (nRowEnd) );
+        String		aTmp( cBuf, pLotusRoot->eCharsetQ );
+        ScfTools::ConvertToScDefinedName( aTmp );
 
-    if( isdigit( *cPuffer ) )
-    {   // erstes Zeichen im Namen eine Zahl -> 'A' vor Namen setzen
-        *pAnsi = 'A';
-        strcpy( pAnsi + 1, cPuffer );
+        pLotusRoot->pRangeNames->Append( pRange, aTmp );
     }
-    else
-        strcpy( pAnsi, cPuffer );
-
-    String      aTmp( pAnsi, pLotusRoot->eCharsetQ );
-    ScfTools::ConvertToScDefinedName( aTmp );
-
-    pLotusRoot->pRangeNames->Append( pRange, aTmp );
 }
 
 
@@ -358,7 +378,7 @@ void OP_Label123( SvStream& r, sal_uInt16 n )
     sal_uInt8      nTab, nCol;
     sal_uInt16    nRow;
     r >> nRow >> nTab >> nCol;
-    n -= 4;
+    n -= (n > 4) ? 4 : n;
 
     sal_Char* pText = new sal_Char[n + 1];
     r.Read( pText, n );
@@ -376,10 +396,14 @@ void OP_Number123( SvStream& r, sal_uInt16 /*n*/ )
     sal_uInt32   nValue;
 
     r >> nRow >> nTab >> nCol >> nValue;
-    double fValue = Snum32ToDouble( nValue );
 
-    ScValueCell *pCell = new ScValueCell( fValue );
-    pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow) && nTab < pDoc->GetMaxTableNumber())
+    {
+        double fValue = Snum32ToDouble( nValue );
+
+        ScValueCell *pCell = new ScValueCell( fValue );
+        pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    }
 }
 
 void OP_Formula123( SvStream& r, sal_uInt16 n )
@@ -391,18 +415,21 @@ void OP_Formula123( SvStream& r, sal_uInt16 n )
     r.SeekRel( 8 );    // Result- jump over
 
     const ScTokenArray* pErg;
-    sal_Int32               nBytesLeft = n - 12;
+    sal_Int32				nBytesLeft = (n > 12) ? n - 12 : 0;
     ScAddress           aAddress( nCol, nRow, nTab );
 
     LotusToSc           aConv( r, pLotusRoot->eCharsetQ, sal_True );
     aConv.Reset( aAddress );
     aConv.Convert( pErg, nBytesLeft );
 
-    ScFormulaCell*      pCell = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow) && nTab < pDoc->GetMaxTableNumber())
+    {
+        ScFormulaCell*		pCell = new ScFormulaCell( pLotusRoot->pDoc, aAddress, pErg );
 
-    pCell->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
+        pCell->AddRecalcMode( RECALCMODE_ONLOAD_ONCE );
 
-    pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+        pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    }
 }
 
 void OP_IEEENumber123( SvStream& r, sal_uInt16 /*n*/ )
@@ -413,8 +440,11 @@ void OP_IEEENumber123( SvStream& r, sal_uInt16 /*n*/ )
 
     r >> nRow >> nTab >> nCol >> dValue;
 
-    ScValueCell *pCell = new ScValueCell(dValue);
-    pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    if (ValidColRow( static_cast<SCCOL>(nCol), nRow) && nTab < pDoc->GetMaxTableNumber())
+    {
+        ScValueCell *pCell = new ScValueCell(dValue);
+        pDoc->PutCell( static_cast<SCCOL>(nCol), static_cast<SCROW>(nRow), static_cast<SCTAB>(nTab), pCell, true );
+    }
 }
 
 void OP_Note123( SvStream& r, sal_uInt16 n)
@@ -422,7 +452,7 @@ void OP_Note123( SvStream& r, sal_uInt16 n)
     sal_uInt8      nTab, nCol;
     sal_uInt16    nRow;
     r >> nRow >> nTab >> nCol;
-    n -= 4;
+    n -= (n > 4) ? 4 : n;
 
     sal_Char* pText = new sal_Char[n + 1];
     r.Read( pText, n );
@@ -505,7 +535,7 @@ void OP_CreatePattern123( SvStream& r, sal_uInt16 n)
     SfxItemSet& rItemSet = aPattern.GetItemSet();
 
     r >> nCode;
-    n = n - 2;
+    n -= (n > 2) ? 2 : n;
 
     if ( nCode == 0x0fd2 )
     {
@@ -540,7 +570,7 @@ void OP_CreatePattern123( SvStream& r, sal_uInt16 n)
         OP_VerAlign123( Ver_Align, rItemSet );
 
         aLotusPatternPool.insert( std::map<sal_uInt16, ScPatternAttr>::value_type( nPatternId, aPattern ) );
-        n = n - 20;
+        n -= (n > 20) ? 20 : n;
     }
     r.SeekRel(n);
 }
@@ -629,15 +659,13 @@ void OP_ApplyPatternArea123( SvStream& rStream )
                 {
                     rStream >> nData;
                     rStream.SeekRel( nLength - 2 );
-                    for( int i = 0; i < nTabCount; i++)
-                    {
-                        std::map<sal_uInt16, ScPatternAttr>::iterator loc = aLotusPatternPool.find( nData );
-
-                        // apparently, files with invalid index occur in the wild -> don't crash then
-                        OSL_ENSURE( loc != aLotusPatternPool.end(), "invalid format index" );
-                        if ( loc != aLotusPatternPool.end() )
+                    std::map<sal_uInt16, ScPatternAttr>::iterator loc = aLotusPatternPool.find( nData );
+                    // #126338# apparently, files with invalid index occur in the wild -> don't crash then
+                    if ( loc != aLotusPatternPool.end() )
+                        for( int i = 0; i < nTabCount; i++)
+                        {
                             pDoc->ApplyPatternAreaTab( nCol, nRow, nCol +  nColCount - 1, nRow + nRowCount - 1, static_cast< SCTAB >( nTab + i ), loc->second );
-                    }
+                        }
                 }
                 else
                     rStream.SeekRel( nLength );
diff --git a/sc/source/filter/lotus/tool.cxx b/sc/source/filter/lotus/tool.cxx
index 34d0fbf0ca0d..44bf49140a86 100644
--- a/sc/source/filter/lotus/tool.cxx
+++ b/sc/source/filter/lotus/tool.cxx
@@ -51,11 +51,7 @@
 
 //--------------------------------------------------------- EXTERNE VARIABLEN -
 extern WKTYP                eTyp;           // -> filter.cxx, aktueller Dateityp
-extern sal_Char*            pDummy2;        // -> memory.cxx
 extern ScDocument*          pDoc;           // -> filter.cxx, Aufhaenger zum Dokumentzugriff
-extern CharSet              eCharNach;      // -> filter.cxx, Zeichenkonvertierung von->nach
-
-extern sal_Bool                 bFormInit;      // -> memory.cxx, fuer GetFormHandle()
 
 //--------------------------------------------------------- GLOBALE VARIABLEN -
 sal_uInt8                       nDefaultFormat; // -> op.cpp, Standard-Zellenformat
@@ -81,6 +77,8 @@ void PutFormString( SCCOL nCol, SCROW nRow, SCTAB nTab, sal_Char* pString )
 {
     // Label-Format-Auswertung
     OSL_ENSURE( pString != NULL, "PutFormString(): pString == NULL" );
+    if (!pString)
+        return;
 
     sal_Char            cForm;
     SvxHorJustifyItem*  pJustify = NULL;
@@ -112,12 +110,9 @@ void PutFormString( SCCOL nCol, SCROW nRow, SCTAB nTab, sal_Char* pString )
             pJustify = pAttrStandard;
     }
 
-    if( pString )
-    {
-        pDoc->ApplyAttr( nCol, nRow, nTab, *pJustify );
-        ScStringCell*   pZelle = new ScStringCell( String( pString, pLotusRoot->eCharsetQ ) );
-        pDoc->PutCell( nCol, nRow, nTab, pZelle, true );
-    }
+    pDoc->ApplyAttr( nCol, nRow, nTab, *pJustify );
+    ScStringCell*	pZelle = new ScStringCell( String( pString, pLotusRoot->eCharsetQ ) );
+    pDoc->PutCell( nCol, nRow, nTab, pZelle, true );
 }