core.git: chart2/source sw/source

[Caolán McNamara (via logerrit)]

 chart2/source/tools/XMLRangeHelper.cxx    |   14 +++++++++++---
 sw/source/core/unocore/XMLRangeHelper.cxx |   14 +++++++++++---
 2 files changed, 22 insertions(+), 6 deletions(-)

New commits:
commit c3c9efc94f737e5f6c42db02b261d8fdb47f3d51
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Tue Oct 15 15:25:40 2024 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Wed Oct 16 20:54:36 2024 +0200

    crashtesting: assert on fdo87790-1.ods
    
    and gnome704765-1.ods
    
    Change-Id: I037b3c7d1f3887634ead05e5464435ae0fbeea60
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/175028
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Tested-by: Jenkins

diff --git a/chart2/source/tools/XMLRangeHelper.cxx 
b/chart2/source/tools/XMLRangeHelper.cxx
index 419c75924926..3c5ed38e3130 100644
--- a/chart2/source/tools/XMLRangeHelper.cxx
+++ b/chart2/source/tools/XMLRangeHelper.cxx
@@ -20,6 +20,7 @@
 #include <XMLRangeHelper.hxx>
 #include <rtl/character.hxx>
 #include <rtl/ustrbuf.hxx>
+#include <sal/log.hxx>
 #include <osl/diagnose.h>
 #include <o3tl/string_view.hxx>
 
@@ -115,7 +116,7 @@ void lcl_getSingleCellAddressFromXMLString(
     std::u16string_view aCellStr = rXMLString.substr( nStartPos, nEndPos - 
nStartPos + 1 );
     const sal_Unicode* pStrArray = aCellStr.data();
     sal_Int32 nLength = aCellStr.size();
-    sal_Int32 i = nLength - 1, nColumn = 0;
+    sal_Int32 i = nLength - 1;
 
     // parse number for row
     while( rtl::isAsciiDigit( pStrArray[ i ] ) && i >= 0 )
@@ -131,14 +132,21 @@ void lcl_getSingleCellAddressFromXMLString(
         rOutCell.bRelativeRow = true;
 
     // parse rest for column
-    assert(i <= 6);
-    sal_Int32 nPower = 1;
+    assert(i <= 13);
+    sal_Int64 nPower = 1;
+    sal_Int64 nColumn = 0;
     while( i >= 0 && rtl::isAsciiAlpha( pStrArray[ i ] ))
     {
         nColumn += (rtl::toAsciiUpperCase(pStrArray[ i ]) - aLetterA + 1) * 
nPower;
         i--;
         nPower *= 26;
     }
+    if (nColumn < SAL_MIN_INT32 || nColumn > SAL_MAX_INT32)
+    {
+        SAL_WARN("chart2", "out of range column");
+        nColumn = 0;
+    }
+
     rOutCell.nColumn = nColumn - 1;
 
     rOutCell.bRelativeColumn = true;
diff --git a/sw/source/core/unocore/XMLRangeHelper.cxx 
b/sw/source/core/unocore/XMLRangeHelper.cxx
index 037fe76d2dbe..f8a49d6041ac 100644
--- a/sw/source/core/unocore/XMLRangeHelper.cxx
+++ b/sw/source/core/unocore/XMLRangeHelper.cxx
@@ -20,6 +20,7 @@
 #include "XMLRangeHelper.hxx"
 #include <rtl/character.hxx>
 #include <rtl/ustrbuf.hxx>
+#include <sal/log.hxx>
 #include <o3tl/string_view.hxx>
 #include <algorithm>
 
@@ -113,7 +114,7 @@ void lcl_getSingleCellAddressFromXMLString(
     std::u16string_view aCellStr = rXMLString.substr( nStartPos, nEndPos - 
nStartPos + 1 );
     const sal_Unicode* pStrArray = aCellStr.data();
     sal_Int32 nLength = aCellStr.size();
-    sal_Int32 i = nLength - 1, nColumn = 0;
+    sal_Int32 i = nLength - 1;
 
     // parse number for row
     while( rtl::isAsciiDigit( pStrArray[ i ] ) && i >= 0 )
@@ -129,14 +130,21 @@ void lcl_getSingleCellAddressFromXMLString(
         rOutCell.bRelativeRow = true;
 
     // parse rest for column
-    assert(i <= 6);
-    sal_Int32 nPower = 1;
+    assert(i <= 13);
+    sal_Int64 nPower = 1;
+    sal_Int64 nColumn = 0;
     while( i >= 0 && rtl::isAsciiAlpha( pStrArray[ i ] ))
     {
         nColumn += (rtl::toAsciiUpperCase(pStrArray[ i ]) - aLetterA + 1) * 
nPower;
         i--;
         nPower *= 26;
     }
+    if (nColumn < SAL_MIN_INT32 || nColumn > SAL_MAX_INT32)
+    {
+        SAL_WARN("sw.uno", "out of range column");
+        nColumn = 0;
+    }
+
     rOutCell.nColumn = nColumn - 1;
 
     rOutCell.bRelativeColumn = true;