[Libreoffice-commits] core.git: 2 commits - sc/source

[Eike Rathke]

 sc/source/core/tool/interpr2.cxx |    7 +++++++
 sc/source/core/tool/interpr4.cxx |    7 +++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

New commits:
commit b9a51c0b1e000865921e0bd4b84827e6f6f12556
Author: Eike Rathke <erack at redhat.com>
Date:   Thu Feb 21 18:56:29 2013 +0100

    assert "can't happen"
    
    Change-Id: I896e29b04568b351517612a1ac161dca5717dfbc

diff --git a/sc/source/core/tool/interpr2.cxx b/sc/source/core/tool/interpr2.cxx
index 7326497..9279c18 100644
--- a/sc/source/core/tool/interpr2.cxx
+++ b/sc/source/core/tool/interpr2.cxx
@@ -2575,6 +2575,9 @@ void ScInterpreter::ScRoman()
 
                 if( (nDigit % 5) == 4 )
                 {
+                    // assert can't happen with nVal<4000 precondition
+                    assert( ((nDigit == 4) ? (nIndex >= 1) : (nIndex >= 2)));
+
                     sal_uInt16 nIndex2 = (nDigit == 4) ? nIndex - 1 : nIndex - 2;
                     sal_uInt16 nSteps = 0;
                     while( (nSteps < nMode) && (nIndex < nMaxIndex) )
@@ -2593,7 +2596,11 @@ void ScInterpreter::ScRoman()
                 else
                 {
                     if( nDigit > 4 )
+                    {
+                        // assert can't happen with nVal<4000 precondition
+                        assert( nIndex >= 1 );
                         aRoman += pChars[ nIndex - 1 ];
+                    }
                     sal_Int32 nPad = nDigit % 5;
                     if (nPad)
                     {
commit 9287760846655c85a564c5b8b546770762121a43
Author: Eike Rathke <erack at redhat.com>
Date:   Thu Feb 21 18:37:55 2013 +0100

    prevent out-of-bounds access for old binary non-UNO add-in function
    
    Change-Id: I6bdce23059d7db337fff0d4eb215b2acdaf18c93

diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
index 04cd1b58..e428749 100644
--- a/sc/source/core/tool/interpr4.cxx
+++ b/sc/source/core/tool/interpr4.cxx
@@ -2545,13 +2545,16 @@ void ScInterpreter::ScExternal()
     FuncData* pFuncData = ScGlobal::GetFuncCollection()->findByName(aFuncName);
     if (pFuncData)
     {
-        if (nParamCount <= MAXFUNCPARAM && nParamCount == pFuncData->GetParamCount() - 1)
+        // Old binary non-UNO add-in function.
+        // NOTE: parameter count is 1-based with the 0th "parameter" being the
+        // return value, included in pFuncDatat->GetParamCount()
+        if (nParamCount < MAXFUNCPARAM && nParamCount == pFuncData->GetParamCount() - 1)
         {
             ParamType   eParamType[MAXFUNCPARAM];
             void*       ppParam[MAXFUNCPARAM];
             double      nVal[MAXFUNCPARAM];
             sal_Char*   pStr[MAXFUNCPARAM];
-            sal_uInt8*       pCellArr[MAXFUNCPARAM];
+            sal_uInt8*  pCellArr[MAXFUNCPARAM];
             short       i;
 
             for (i = 0; i < MAXFUNCPARAM; i++)