diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2019-10-20 12:30:32 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2019-10-20 16:22:35 +0200 |
| commit | 531600e390ec14f5ac39979d8234283993a85ef9 (patch) | |
| tree | 00f7ad76d8772caf7af651f5c0845b699a6878aa /sc | |
| parent | dbf445b69100c4cb931179abc316a456e02a60df (diff) | |
cid#1448338 Untrusted value as argument
Change-Id: Ifba1ab62cb7681a5fba2e50fb74870e234f14769
Reviewed-on: https://gerrit.libreoffice.org/81161
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/filter/lotus/op.cxx | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/sc/source/filter/lotus/op.cxx b/sc/source/filter/lotus/op.cxx index a9a3ba9692f6..b59550f80338 100644 --- a/sc/source/filter/lotus/op.cxx +++ b/sc/source/filter/lotus/op.cxx @@ -576,12 +576,9 @@ void OP_SheetName123(LotusContext& rContext, SvStream& rStream, sal_uInt16 nLeng } // B0 36 [sheet number (2 bytes?)] [sheet name (null terminated char array)] - - sal_uInt16 nDummy; - rStream.ReadUInt16( nDummy ); // ignore the first 2 bytes (B0 36). - rStream.ReadUInt16( nDummy ); - SCTAB nSheetNum = static_cast<SCTAB>(nDummy); - rContext.pDoc->MakeTable(nSheetNum); + rStream.SeekRel(2); // ignore the first 2 bytes (B0 36). + sal_uInt16 nSheetNum(0); + rStream.ReadUInt16(nSheetNum); ::std::vector<sal_Char> sSheetName; sSheetName.reserve(nLength-4); @@ -592,10 +589,12 @@ void OP_SheetName123(LotusContext& rContext, SvStream& rStream, sal_uInt16 nLeng sSheetName.push_back(c); } + if (!ValidTab(nSheetNum)) + return; + + rContext.pDoc->MakeTable(nSheetNum); if (!sSheetName.empty()) { - if (!ValidTab(nSheetNum) || nSheetNum >= rContext.pDoc->GetTableCount()) - return; OUString aName(sSheetName.data(), strlen(sSheetName.data()), rContext.eCharVon); rContext.pDoc->RenameTab(nSheetNum, aName); } |