diff options
| -rw-r--r-- | sc/qa/unit/data/xls/pass/crash-1.xls | bin | 0 -> 4096 bytes | |||
| -rw-r--r-- | sc/source/filter/excel/xicontent.cxx | 11 |
2 files changed, 8 insertions, 3 deletions
diff --git a/sc/qa/unit/data/xls/pass/crash-1.xls b/sc/qa/unit/data/xls/pass/crash-1.xls Binary files differnew file mode 100644 index 000000000000..724bfc1a6f14 --- /dev/null +++ b/sc/qa/unit/data/xls/pass/crash-1.xls diff --git a/sc/source/filter/excel/xicontent.cxx b/sc/source/filter/excel/xicontent.cxx index d821a8ad5266..6b0f688a8f9e 100644 --- a/sc/source/filter/excel/xicontent.cxx +++ b/sc/source/filter/excel/xicontent.cxx @@ -75,10 +75,15 @@ XclImpSst::XclImpSst( const XclImpRoot& rRoot ) : void XclImpSst::ReadSst( XclImpStream& rStrm ) { rStrm.Ignore( 4 ); - sal_uInt32 nStrCount(0); - nStrCount = rStrm.ReaduInt32(); + sal_uInt32 nStrCount = rStrm.ReaduInt32(); + auto nBytesAvailable = rStrm.GetRecLeft(); + if (nStrCount > nBytesAvailable) + { + SAL_WARN("sc.filter", "xls claimed to have " << nStrCount << " strings, but only " << nBytesAvailable << " bytes available, truncating"); + nStrCount = nBytesAvailable; + } maStrings.clear(); - maStrings.reserve( static_cast< size_t >( nStrCount ) ); + maStrings.reserve(nStrCount); while( (nStrCount > 0) && rStrm.IsValid() ) { XclImpString aString; |