diff options
| author | Eike Rathke <erack@redhat.com> | 2018-01-31 18:00:15 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2018-01-31 18:09:48 +0100 |
| commit | d2473faee119c35b518849afe3daa6977a751c68 (patch) | |
| tree | e30d631dc70d8c698e9232cb44b1f046acd66c1e /sc | |
| parent | e80da60895b45309fa1d018760d5f11cca4367f4 (diff) | |
ofz: guard against binary crap argument counts and ID/OpCode generation
Same as in sc/source/filter/lotus/lotform.cxx LotusToSc::DoFunc()
Change-Id: I4972e065ab96abdea42d64481d4e30674230ab99
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/filter/qpro/qproform.cxx | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sc/source/filter/qpro/qproform.cxx b/sc/source/filter/qpro/qproform.cxx index 6a2a22c1be95..6555a7842037 100644 --- a/sc/source/filter/qpro/qproform.cxx +++ b/sc/source/filter/qpro/qproform.cxx @@ -94,8 +94,12 @@ void QProToSc::DoFunc( DefTokenId eOc, sal_uInt16 nArgs, const sal_Char* pExtStr if( nArgs < nBufSize ) { - for( nCount = 0; nCount < nArgs ; nCount++ ) + for( nCount = 0; nCount < nArgs && aStack.HasMoreTokens() ; nCount++ ) aStack >> eParam[ nCount ]; + + if (nCount < nArgs) + // Adapt count to reality. All sort of binary crap is possible. + nArgs = static_cast<sal_uInt16>(nCount); } else return; |