diff options
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/filter/excel/xistring.cxx | 11 | ||||
| -rw-r--r-- | sc/source/filter/inc/xistream.hxx | 4 |
2 files changed, 15 insertions, 0 deletions
diff --git a/sc/source/filter/excel/xistring.cxx b/sc/source/filter/excel/xistring.cxx index 096507ba8351..80b2e5140c21 100644 --- a/sc/source/filter/excel/xistring.cxx +++ b/sc/source/filter/excel/xistring.cxx @@ -113,6 +113,17 @@ void XclImpString::ReadFormats( XclImpStream& rStrm, XclFormatRunVec& rFormats ) void XclImpString::ReadFormats( XclImpStream& rStrm, XclFormatRunVec& rFormats, sal_uInt16 nRunCount ) { rFormats.clear(); + + size_t nElementSize = rStrm.GetRoot().GetBiff() == EXC_BIFF8 ? 4 : 2; + size_t nAvailableBytes = rStrm.GetRecLeft(); + size_t nMaxElements = nAvailableBytes / nElementSize; + if (nRunCount > nMaxElements) + { + SAL_WARN("sc.filter", "XclImpString::ReadFormats - more formats claimed than stream could contain"); + rStrm.SetSvStreamError(SVSTREAM_FILEFORMAT_ERROR); + return; + } + rFormats.reserve( nRunCount ); /* #i33341# real life -- same character index may occur several times -> use AppendFormat() to validate formats */ diff --git a/sc/source/filter/inc/xistream.hxx b/sc/source/filter/inc/xistream.hxx index 15cde8c9a911..855ff2c3219c 100644 --- a/sc/source/filter/inc/xistream.hxx +++ b/sc/source/filter/inc/xistream.hxx @@ -466,6 +466,10 @@ public: /** Restores stream position contained in rPos. */ void RestorePosition( const XclImpStreamPos& rPos ); + /** Set an SVSTREAM_..._ERROR. */ + void SetSvStreamError( const ErrCode& rErrCode ) + { mrStrm.SetError( rErrCode ); } + private: /** Seeks to next raw record header and reads record ID and size. @descr This is a "raw" function, means that stream members are |