sc/source/filter/qpro/qproform.cxx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
New commits: commit d2473faee119c35b518849afe3daa6977a751c68 Author: Eike Rathke <[email protected]> Date: Wed Jan 31 18:00:15 2018 +0100 ofz: guard against binary crap argument counts and ID/OpCode generation Same as in sc/source/filter/lotus/lotform.cxx LotusToSc::DoFunc() Change-Id: I4972e065ab96abdea42d64481d4e30674230ab99 diff --git a/sc/source/filter/qpro/qproform.cxx b/sc/source/filter/qpro/qproform.cxx index 6a2a22c1be95..6555a7842037 100644 --- a/sc/source/filter/qpro/qproform.cxx +++ b/sc/source/filter/qpro/qproform.cxx @@ -94,8 +94,12 @@ void QProToSc::DoFunc( DefTokenId eOc, sal_uInt16 nArgs, const sal_Char* pExtStr if( nArgs < nBufSize ) { - for( nCount = 0; nCount < nArgs ; nCount++ ) + for( nCount = 0; nCount < nArgs && aStack.HasMoreTokens() ; nCount++ ) aStack >> eParam[ nCount ]; + + if (nCount < nArgs) + // Adapt count to reality. All sort of binary crap is possible. + nArgs = static_cast<sal_uInt16>(nCount); } else return; _______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
