sc/source/filter/qpro/qpro.cxx | 5 ++++
sc/source/filter/qpro/qproform.cxx | 39 ++++++++++++++++++++++++-------------
2 files changed, 31 insertions(+), 13 deletions(-)
New commits:
commit 5b51f45bcbf5fb70b7e53d9deaf5663402f61b27
Author: Eike Rathke <er...@redhat.com>
Date: Wed Jan 31 18:00:15 2018 +0100
ofz: do not force non-existent parameters into the TokenPool
This is a combination of 4 commits.
ofz: guard against binary crap argument counts and ID/OpCode generation
Same as in sc/source/filter/lotus/lotform.cxx LotusToSc::DoFunc()
(cherry picked from commit d2473faee119c35b518849afe3daa6977a751c68)
ofz: do not force non-existent parameters into the TokenPool
Apart from that, the hard coded storage order for ocRRI and ocIpmt
did the same as the general loop, just with a fixed number of
parameters. Instead, limit the number of arguments for the loop
for these opcodes.
(cherry picked from commit bc697917c79609243305dcecc7aeef2f3776611c)
Author was too dumb to adjust a copy-pasta digit
(cherry picked from commit 6fc7f3f8409040a3d977b944b3fa4151faf31301)
Check for end-of-stream after reading formula headers
(cherry picked from commit 1698425c6e2341835aef8c405c06482d4d78d73a)
378ccaf60da61c1a385555451456d8422ee33c50
7d171fdf21c02af9a14600c5e0c6294c0f3ebb57
0de0ceeda63d733779aa595bdbd0f2be97827694
Change-Id: I4972e065ab96abdea42d64481d4e30674230ab99
Reviewed-on: https://gerrit.libreoffice.org/49120
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sc/source/filter/qpro/qpro.cxx b/sc/source/filter/qpro/qpro.cxx
index 0c1d18d59ffd..e7e2a6d17d27 100644
--- a/sc/source/filter/qpro/qpro.cxx
+++ b/sc/source/filter/qpro/qpro.cxx
@@ -101,6 +101,11 @@ ErrCode ScQProReader::readSheet( SCTAB nTab, ScDocument*
pDoc, ScQProStyle *pSty
double nValue;
sal_uInt16 nState, nLen;
mpStream->ReadUChar( nCol ).ReadUChar( nDummy ).ReadUInt16(
nRow ).ReadUInt16( nStyle ).ReadDouble( nValue ).ReadUInt16( nState
).ReadUInt16( nLen );
+ if (!mpStream->good())
+ {
+ eRet = SCERR_IMPORT_FORMAT;
+ break;
+ }
ScAddress aAddr( nCol, nRow, nTab );
const ScTokenArray *pArray;
diff --git a/sc/source/filter/qpro/qproform.cxx
b/sc/source/filter/qpro/qproform.cxx
index 73da364969c9..e4a83bcee6e4 100644
--- a/sc/source/filter/qpro/qproform.cxx
+++ b/sc/source/filter/qpro/qproform.cxx
@@ -94,8 +94,12 @@ void QProToSc::DoFunc( DefTokenId eOc, sal_uInt16 nArgs,
const sal_Char* pExtStr
if( nArgs < nBufSize )
{
- for( nCount = 0; nCount < nArgs ; nCount++ )
+ for( nCount = 0; nCount < nArgs && aStack.HasMoreTokens() ; nCount++ )
aStack >> eParam[ nCount ];
+
+ if (nCount < nArgs)
+ // Adapt count to reality. All sort of binary crap is possible.
+ nArgs = static_cast<sal_uInt16>(nCount);
}
else
return;
@@ -132,20 +136,29 @@ void QProToSc::DoFunc( DefTokenId eOc, sal_uInt16 nArgs,
const sal_Char* pExtStr
if( nArgs> 0 )
{
- sal_Int16 nLast = nArgs- 1;
-
if( eOc == ocRRI )
- aPool << eParam[ 2 ] << ocSep << eParam[ 1 ] << ocSep << eParam[ 0
];
- if( eOc == ocIpmt )
- aPool << eParam[ 3 ] << ocSep << eParam[ 2 ] << ocSep << eParam[ 1
] << ocSep << eParam[ 0 ];
- else
{
- aPool << eParam[ nLast ];
- for( nCount = nLast - 1 ; nCount >= 0 ; nCount-- )
- {
- if( nCount != -1 )
- aPool << ocSep << eParam[ nCount ];
- }
+ // There should be at least 3 arguments, but with binary crap may
not..
+ SAL_WARN_IF( nArgs < 3, "sc.filter","QProToSc::DoFunc - ocRRI
expects 3 parameters but got " << nArgs);
+ // Store first 3 parameters to pool in order 2,1,0
+ if (nArgs > 3)
+ nArgs = 3;
+ }
+ else if( eOc == ocIpmt )
+ {
+ // There should be at least 4 arguments, but with binary crap may
not..
+ SAL_WARN_IF( nArgs < 4, "sc.filter","QProToSc::DoFunc - ocIpmt
expects 4 parameters but got " << nArgs);
+ // Store first 4 parameters to pool in order 3,2,1,0
+ if (nArgs > 4)
+ nArgs = 4;
+ }
+
+ sal_Int16 nLast = nArgs - 1;
+ aPool << eParam[ nLast ];
+ for( nCount = nLast - 1 ; nCount >= 0 ; nCount-- )
+ {
+ if( nCount != -1 )
+ aPool << ocSep << eParam[ nCount ];
}
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
