diff options
| author | Eike Rathke <erack@redhat.com> | 2013-02-21 18:37:55 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2013-02-21 18:58:44 +0100 |
| commit | 9287760846655c85a564c5b8b546770762121a43 (patch) | |
| tree | cc6619ce9425e528c64bd2f86ed33cf325cb8154 /sc | |
| parent | 6b300173343e74531c516e24cd931e35d747b84d (diff) | |
prevent out-of-bounds access for old binary non-UNO add-in function
Change-Id: I6bdce23059d7db337fff0d4eb215b2acdaf18c93
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/core/tool/interpr4.cxx | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx index 04cd1b58ed92..e4287493c8b8 100644 --- a/sc/source/core/tool/interpr4.cxx +++ b/sc/source/core/tool/interpr4.cxx @@ -2545,13 +2545,16 @@ void ScInterpreter::ScExternal() FuncData* pFuncData = ScGlobal::GetFuncCollection()->findByName(aFuncName); if (pFuncData) { - if (nParamCount <= MAXFUNCPARAM && nParamCount == pFuncData->GetParamCount() - 1) + // Old binary non-UNO add-in function. + // NOTE: parameter count is 1-based with the 0th "parameter" being the + // return value, included in pFuncDatat->GetParamCount() + if (nParamCount < MAXFUNCPARAM && nParamCount == pFuncData->GetParamCount() - 1) { ParamType eParamType[MAXFUNCPARAM]; void* ppParam[MAXFUNCPARAM]; double nVal[MAXFUNCPARAM]; sal_Char* pStr[MAXFUNCPARAM]; - sal_uInt8* pCellArr[MAXFUNCPARAM]; + sal_uInt8* pCellArr[MAXFUNCPARAM]; short i; for (i = 0; i < MAXFUNCPARAM; i++) |