[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - formula/source include/formula

[Eike Rathke]

 formula/source/core/api/FormulaCompiler.cxx |    8 ++++++--
 include/formula/FormulaCompiler.hxx         |    1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

New commits:
commit 1d1bdfd94fc2963d0281ea4fd8d3a98e39f4ccf7
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Jul 4 15:22:23 2017 +0200

    Set error on more than max params (255) per function
    
    Parameter count is size byte, so.. SUM(1,1,1,...) with 256 arguments resulted
    in 0 (uint8 wrapping around).
    
    (cherry picked from commit 209cc5c211260a6c20cc6fb5ac02fd5a88100314)
    
    Change-Id: Ib9997ad0d0d13d4c5171f276148b6c5cad570d5b
    Reviewed-on: https://gerrit.libreoffice.org/39506
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx
index 07c39037585a..2a561d2182e3 100644
--- a/formula/source/core/api/FormulaCompiler.cxx
+++ b/formula/source/core/api/FormulaCompiler.cxx
@@ -1511,7 +1511,7 @@ void FormulaCompiler::Factor()
                 }
                 else
                     SetError( FormulaError::PairExpected);
-                sal_uInt8 nSepCount = 0;
+                sal_uInt32 nSepCount = 0;
                 const sal_uInt16 nSepPos = pArr->nIndex - 1;    // separator position, if any
                 if( !bNoParam )
                 {
@@ -1521,6 +1521,8 @@ void FormulaCompiler::Factor()
                         NextToken();
                         CheckSetForceArrayParameter( mpToken, nSepCount);
                         nSepCount++;
+                        if (nSepCount > FORMULA_MAXPARAMS)
+                            SetError( FormulaError::CodeOverflow);
                         eOp = Expression();
                     }
                 }
@@ -1617,7 +1619,7 @@ void FormulaCompiler::Factor()
             }
             else
                 SetError( FormulaError::PairExpected);
-            sal_uInt8 nSepCount = 0;
+            sal_uInt32 nSepCount = 0;
             if( !bNoParam )
             {
                 nSepCount++;
@@ -1626,6 +1628,8 @@ void FormulaCompiler::Factor()
                     NextToken();
                     CheckSetForceArrayParameter( mpToken, nSepCount);
                     nSepCount++;
+                    if (nSepCount > FORMULA_MAXPARAMS)
+                        SetError( FormulaError::CodeOverflow);
                     eOp = Expression();
                 }
             }
diff --git a/include/formula/FormulaCompiler.hxx b/include/formula/FormulaCompiler.hxx
index 37da2ef8becc..5293c504b1dd 100644
--- a/include/formula/FormulaCompiler.hxx
+++ b/include/formula/FormulaCompiler.hxx
@@ -38,6 +38,7 @@
 
 #define FORMULA_MAXJUMPCOUNT    32  /* maximum number of jumps (ocChoose) */
 #define FORMULA_MAXTOKENS     8192  /* maximum number of tokens in formula */
+#define FORMULA_MAXPARAMS      255  /* maximum number of parameters per function (byte) */
 
 
 namespace com { namespace sun { namespace star {