[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - formula/source include/formula

[Eike Rathke]

 formula/source/core/api/FormulaCompiler.cxx |    8 ++++++--
 include/formula/FormulaCompiler.hxx         |    1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

New commits:
commit c2348bbbbd960e29087f0578244f3be7f4df4c8c
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Jul 4 15:22:23 2017 +0200

    Set error on more than max params (255) per function
    
    Parameter count is size byte, so.. SUM(1,1,1,...) with 256 arguments resulted
    in 0 (uint8 wrapping around).
    
    (cherry picked from commit 209cc5c211260a6c20cc6fb5ac02fd5a88100314)
    
    Change-Id: Ib9997ad0d0d13d4c5171f276148b6c5cad570d5b
    Reviewed-on: https://gerrit.libreoffice.org/39505
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx
index b626039efed7..037d2fb745b0 100644
--- a/formula/source/core/api/FormulaCompiler.cxx
+++ b/formula/source/core/api/FormulaCompiler.cxx
@@ -1493,7 +1493,7 @@ void FormulaCompiler::Factor()
                 }
                 else
                     SetError( FormulaError::PairExpected);
-                sal_uInt8 nSepCount = 0;
+                sal_uInt32 nSepCount = 0;
                 const sal_uInt16 nSepPos = pArr->nIndex - 1;    // separator position, if any
                 if( !bNoParam )
                 {
@@ -1503,6 +1503,8 @@ void FormulaCompiler::Factor()
                         NextToken();
                         CheckSetForceArrayParameter( mpToken, nSepCount);
                         nSepCount++;
+                        if (nSepCount > FORMULA_MAXPARAMS)
+                            SetError( FormulaError::CodeOverflow);
                         eOp = Expression();
                     }
                 }
@@ -1599,7 +1601,7 @@ void FormulaCompiler::Factor()
             }
             else
                 SetError( FormulaError::PairExpected);
-            sal_uInt8 nSepCount = 0;
+            sal_uInt32 nSepCount = 0;
             if( !bNoParam )
             {
                 nSepCount++;
@@ -1608,6 +1610,8 @@ void FormulaCompiler::Factor()
                     NextToken();
                     CheckSetForceArrayParameter( mpToken, nSepCount);
                     nSepCount++;
+                    if (nSepCount > FORMULA_MAXPARAMS)
+                        SetError( FormulaError::CodeOverflow);
                     eOp = Expression();
                 }
             }
diff --git a/include/formula/FormulaCompiler.hxx b/include/formula/FormulaCompiler.hxx
index f6650201bba1..f105250181fc 100644
--- a/include/formula/FormulaCompiler.hxx
+++ b/include/formula/FormulaCompiler.hxx
@@ -39,6 +39,7 @@
 
 #define FORMULA_MAXJUMPCOUNT    32  /* maximum number of jumps (ocChoose) */
 #define FORMULA_MAXTOKENS     8192  /* maximum number of tokens in formula */
+#define FORMULA_MAXPARAMS      255  /* maximum number of parameters per function (byte) */
 
 
 namespace com { namespace sun { namespace star {