diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-10-09 16:22:56 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-10-09 16:26:20 +0100 |
| commit | 5d826db15beaff4f0930724431d34f7103111591 (patch) | |
| tree | c8c7e49d96d45ac3fe61d8ba0664d89132a5b288 /sc | |
| parent | 587c02d2554111528a8c590dad9992bb423305a5 (diff) | |
crashtesting: ooo95537-1.xls fails with a fAnz that is nan
so it happily passes the pre-cast string bounds check and blows
up in the post-cast string access
Change-Id: Ifd4d087b37e8a84d886e2f7833dfc773b8bf1343
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/core/tool/interpr1.cxx | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx index 5d423ce21bfc..b9cdc1c4e838 100644 --- a/sc/source/core/tool/interpr1.cxx +++ b/sc/source/core/tool/interpr1.cxx @@ -7877,17 +7877,17 @@ void ScInterpreter::ScFind() sal_uInt8 nParamCount = GetByte(); if ( MustHaveParamCount( nParamCount, 2, 3 ) ) { - double fAnz; + sal_Int32 nAnz; if (nParamCount == 3) - fAnz = GetDouble(); + nAnz = GetDouble(); else - fAnz = 1.0; + nAnz = 1; OUString sStr = GetString().getString(); - if( fAnz < 1.0 || fAnz > (double) sStr.getLength() ) + if (nAnz < 1 || nAnz > sStr.getLength()) PushNoValue(); else { - sal_Int32 nPos = sStr.indexOf(GetString().getString(), static_cast<sal_Int32>(fAnz - 1)); + sal_Int32 nPos = sStr.indexOf(GetString().getString(), nAnz - 1); if (nPos == -1) PushNoValue(); else |