From 8de38977838d5a044271cb170730e3d557659f17 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 2 Apr 2021 14:28:37 +0100
Subject: ofz: Segv on unknown address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I6c69375a89781fc0b87230203335c861efb562f9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113518
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
---
 sc/source/core/tool/compiler.cxx | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

(limited to 'sc')

diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx
index 250e816a2e5e..faf5d587de42 100644
--- a/sc/source/core/tool/compiler.cxx
+++ b/sc/source/core/tool/compiler.cxx
@@ -2638,7 +2638,14 @@ Label_MaskStateMachine:
                                 if (eState != ssSkipReference)
                                 {
                                     *pSym++ = c;
-                                    *pSym++ = *pSrc++;
+
+                                    if( pSym == &cSymbol[ MAXSTRLEN ] )
+                                    {
+                                        SetError( FormulaError::StringOverflow);
+                                        eState = ssStop;
+                                    }
+                                    else
+                                        *pSym++ = *pSrc++;
                                 }
                                 bAddToSymbol = false;
                             }
-- 
cgit