sc/source/core/tool/interpr1.cxx | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
New commits:
commit e88019a9c1d6fcaa3d116192ad392ed1fdad2cd2
Author: Caolán McNamara <caol...@redhat.com>
Date: Fri Oct 9 16:22:56 2015 +0100
crashtesting: ooo95537-1.xls fails with a fAnz that is nan
so it happily passes the pre-cast string bounds check and blows
up in the post-cast string access
Change-Id: Ifd4d087b37e8a84d886e2f7833dfc773b8bf1343
(cherry picked from commit 5d826db15beaff4f0930724431d34f7103111591)
Reviewed-on: https://gerrit.libreoffice.org/19280
Reviewed-by: Markus Mohrhard <markus.mohrh...@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrh...@googlemail.com>
diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
index ff8a990..68802ae 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -7830,17 +7830,17 @@ void ScInterpreter::ScFind()
sal_uInt8 nParamCount = GetByte();
if ( MustHaveParamCount( nParamCount, 2, 3 ) )
{
- double fAnz;
+ sal_Int32 nAnz;
if (nParamCount == 3)
- fAnz = GetDouble();
+ nAnz = GetDouble();
else
- fAnz = 1.0;
+ nAnz = 1;
OUString sStr = GetString().getString();
- if( fAnz < 1.0 || fAnz > (double) sStr.getLength() )
+ if (nAnz < 1 || nAnz > sStr.getLength())
PushNoValue();
else
{
- sal_Int32 nPos = sStr.indexOf(GetString().getString(),
static_cast<sal_Int32>(fAnz - 1));
+ sal_Int32 nPos = sStr.indexOf(GetString().getString(), nAnz - 1);
if (nPos == -1)
PushNoValue();
else
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
