diff options
| -rw-r--r-- | sc/source/filter/excel/xistream.cxx | 4 | ||||
| -rw-r--r-- | sc/source/filter/xcl97/XclImpChangeTrack.cxx | 13 |
2 files changed, 15 insertions, 2 deletions
diff --git a/sc/source/filter/excel/xistream.cxx b/sc/source/filter/excel/xistream.cxx index 753839cada2b..8cd9980821ec 100644 --- a/sc/source/filter/excel/xistream.cxx +++ b/sc/source/filter/excel/xistream.cxx @@ -822,7 +822,9 @@ sal_Size XclImpStream::CopyToStream( SvStream& rOutStrm, sal_Size nBytes ) { sal_Size nReadSize = ::std::min( nBytesLeft, nMaxBuffer ); nRet += Read( pnBuffer, nReadSize ); - rOutStrm.Write( pnBuffer, nReadSize ); + // writing more bytes than read results in invalid memory access + SAL_WARN_IF(nRet != nReadSize, "sc", "read less bytes than requested"); + rOutStrm.Write( pnBuffer, nRet ); nBytesLeft -= nReadSize; } diff --git a/sc/source/filter/xcl97/XclImpChangeTrack.cxx b/sc/source/filter/xcl97/XclImpChangeTrack.cxx index 926c537b5aed..ecb8b6e58c8e 100644 --- a/sc/source/filter/xcl97/XclImpChangeTrack.cxx +++ b/sc/source/filter/xcl97/XclImpChangeTrack.cxx @@ -197,7 +197,18 @@ void XclImpChangeTrack::ReadFormula( ScTokenArray*& rpTokenArray, const ScAddres // converter in each formula) SvMemoryStream aMemStrm; aMemStrm << (sal_uInt16) 0x0001 << nFmlSize; - pStrm->CopyToStream( aMemStrm, nFmlSize ); + size_t nRead = pStrm->CopyToStream( aMemStrm, nFmlSize ); + + // survive reading invalid streams! + // if we can't read as many bytes as required just don't use them and + // assume that this part is broken + if(nRead != nFmlSize) + { + rpTokenArray = NULL; + pStrm->Ignore(1); + return; + } + XclImpStream aFmlaStrm( aMemStrm, GetRoot() ); aFmlaStrm.StartNextRecord(); XclImpChTrFmlConverter aFmlConv( GetRoot(), *this ); |