[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - sc/source

[Caolán McNamara]

 sc/source/core/tool/interpr1.cxx |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

New commits:
commit e88019a9c1d6fcaa3d116192ad392ed1fdad2cd2
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Oct 9 16:22:56 2015 +0100

    crashtesting: ooo95537-1.xls fails with a fAnz that is nan
    
    so it happily passes the pre-cast string bounds check and blows
    up in the post-cast string access
    
    Change-Id: Ifd4d087b37e8a84d886e2f7833dfc773b8bf1343
    (cherry picked from commit 5d826db15beaff4f0930724431d34f7103111591)
    Reviewed-on: https://gerrit.libreoffice.org/19280
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
index ff8a990..68802ae 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -7830,17 +7830,17 @@ void ScInterpreter::ScFind()
     sal_uInt8 nParamCount = GetByte();
     if ( MustHaveParamCount( nParamCount, 2, 3 ) )
     {
-        double fAnz;
+        sal_Int32 nAnz;
         if (nParamCount == 3)
-            fAnz = GetDouble();
+            nAnz = GetDouble();
         else
-            fAnz = 1.0;
+            nAnz = 1;
         OUString sStr = GetString().getString();
-        if( fAnz < 1.0 || fAnz > (double) sStr.getLength() )
+        if (nAnz < 1 || nAnz > sStr.getLength())
             PushNoValue();
         else
         {
-            sal_Int32 nPos = sStr.indexOf(GetString().getString(), static_cast<sal_Int32>(fAnz - 1));
+            sal_Int32 nPos = sStr.indexOf(GetString().getString(), nAnz - 1);
             if (nPos == -1)
                 PushNoValue();
             else