sc/source/filter/excel/xltoolbar.cxx | 6 ++++++
1 file changed, 6 insertions(+)
New commits:
commit 05d651673bdd8bcda97c064421b1ab69bf144e58
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Mar 29 10:35:56 2021 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Mon Mar 29 14:00:55 2021 +0200
cid#1242796 Untrusted loop bound
Change-Id: I0ad070da424f7ce98a78104f017be26c411364a5
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113302
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sc/source/filter/excel/xltoolbar.cxx
b/sc/source/filter/excel/xltoolbar.cxx
index 7b4e40482a54..b15006a36813 100644
--- a/sc/source/filter/excel/xltoolbar.cxx
+++ b/sc/source/filter/excel/xltoolbar.cxx
@@ -81,6 +81,12 @@ bool ScCTB::Read( SvStream &rS )
SAL_INFO("sc.filter", "stream pos " << rS.Tell());
nOffSet = rS.Tell();
tb.Read( rS );
+
+ const size_t nMinRecordSize = 20; // TBVisualData reads 20 bytes
+ const size_t nMaxPossibleRecords = rS.remainingSize() / nMinRecordSize;
+ if (nViews > nMaxPossibleRecords)
+ return false;
+
for ( sal_uInt16 index = 0; index < nViews; ++index )
{
TBVisualData aVisData;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
