[Libreoffice-commits] core.git: formula/source include/formula

[Eike Rathke]

 formula/source/core/api/FormulaCompiler.cxx |    8 ++++++--
 include/formula/FormulaCompiler.hxx         |    1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

New commits:
commit 209cc5c211260a6c20cc6fb5ac02fd5a88100314
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Jul 4 15:22:23 2017 +0200

    Set error on more than max params (255) per function
    
    Parameter count is size byte, so.. SUM(1,1,1,...) with 256 arguments resulted
    in 0 (uint8 wrapping around).
    
    Change-Id: Ib9997ad0d0d13d4c5171f276148b6c5cad570d5b

diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx
index 2f82f3b022a6..389b2e719350 100644
--- a/formula/source/core/api/FormulaCompiler.cxx
+++ b/formula/source/core/api/FormulaCompiler.cxx
@@ -1490,7 +1490,7 @@ void FormulaCompiler::Factor()
                 }
                 else
                     SetError( FormulaError::PairExpected);
-                sal_uInt8 nSepCount = 0;
+                sal_uInt32 nSepCount = 0;
                 const sal_uInt16 nSepPos = maArrIterator.GetIndex() - 1;    // separator position, if any
                 if( !bNoParam )
                 {
@@ -1500,6 +1500,8 @@ void FormulaCompiler::Factor()
                         NextToken();
                         CheckSetForceArrayParameter( mpToken, nSepCount);
                         nSepCount++;
+                        if (nSepCount > FORMULA_MAXPARAMS)
+                            SetError( FormulaError::CodeOverflow);
                         eOp = Expression();
                     }
                 }
@@ -1597,7 +1599,7 @@ void FormulaCompiler::Factor()
             }
             else
                 SetError( FormulaError::PairExpected);
-            sal_uInt8 nSepCount = 0;
+            sal_uInt32 nSepCount = 0;
             if( !bNoParam )
             {
                 nSepCount++;
@@ -1606,6 +1608,8 @@ void FormulaCompiler::Factor()
                     NextToken();
                     CheckSetForceArrayParameter( mpToken, nSepCount);
                     nSepCount++;
+                    if (nSepCount > FORMULA_MAXPARAMS)
+                        SetError( FormulaError::CodeOverflow);
                     eOp = Expression();
                 }
             }
diff --git a/include/formula/FormulaCompiler.hxx b/include/formula/FormulaCompiler.hxx
index 970909cd9f00..31a3cf5e5ee4 100644
--- a/include/formula/FormulaCompiler.hxx
+++ b/include/formula/FormulaCompiler.hxx
@@ -40,6 +40,7 @@
 
 #define FORMULA_MAXJUMPCOUNT    32  /* maximum number of jumps (ocChoose) */
 #define FORMULA_MAXTOKENS     8192  /* maximum number of tokens in formula */
+#define FORMULA_MAXPARAMS      255  /* maximum number of parameters per function (byte) */
 
 
 namespace com { namespace sun { namespace star {