[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - sc/source

[Eike Rathke]

 sc/source/filter/qpro/qproform.cxx |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

New commits:
commit d78b60fc7b7acb6675afe077968cd23586092c96
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Oct 27 11:39:39 2017 +0200

    ofz#2947 check for input stream end
    
    Change-Id: I48d43a358e9a8e37a3c862c310a2e4b2e756f536
    Reviewed-on: https://gerrit.libreoffice.org/43937
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit b53974c1530d14eebdc561ada3ecaf8fc3b58929)
    Reviewed-on: https://gerrit.libreoffice.org/43946
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/source/filter/qpro/qproform.cxx b/sc/source/filter/qpro/qproform.cxx
index 4ec3f386a338..0726f48d52e3 100644
--- a/sc/source/filter/qpro/qproform.cxx
+++ b/sc/source/filter/qpro/qproform.cxx
@@ -172,6 +172,14 @@ do { \
     nRef-=amt; \
 } while(false)
 
+#define SAFEREAD_OR_BREAK( aStream, i, nRef, eRet, ret ) \
+    if (!aStream.good()) \
+    { \
+        i = nRef-1;     /* will be incremented at end of while */ \
+        eRet = ret; \
+        break;          /* switch */ \
+    }
+
 ConvErr QProToSc::Convert( const ScTokenArray*& pArray )
 {
     sal_uInt8 nFmla[ nBufSize ], nArg;
@@ -245,6 +253,7 @@ ConvErr QProToSc::Convert( const ScTokenArray*& pArray )
     nDLLCount = 0;
     nArgCount = 0;
     nStringCount = 0;
+    ConvErr eRet = ConvErr::OK;
 
     while( i < nRef && ( nFmla[ i ] != 0x03 ) )
     {
@@ -298,14 +307,17 @@ ConvErr QProToSc::Convert( const ScTokenArray*& pArray )
 
             case FT_Cref : // Single cell reference
                 maIn.ReadUInt16( nNote ).ReadSChar( nCol ).ReadSChar( nPage ).ReadUInt16( nRelBits );
+                SAFEREAD_OR_BREAK( maIn, i, nRef, eRet, ConvErr::Count);
                 ReadSRD( aSRD, nPage, nCol, nRelBits );
                 aStack << aPool.Store( aSRD );
                 break;
 
             case FT_Range: // Block reference
                 maIn.ReadUInt16( nNote ).ReadSChar( nCol ).ReadSChar( nPage ).ReadUInt16( nRelBits );
+                SAFEREAD_OR_BREAK( maIn, i, nRef, eRet, ConvErr::Count);
                 ReadSRD( aCRD.Ref1, nPage, nCol, nRelBits );
                 maIn.ReadSChar( nCol ).ReadSChar( nPage ).ReadUInt16( nRelBits );
+                SAFEREAD_OR_BREAK( maIn, i, nRef, eRet, ConvErr::Count);
                 ReadSRD( aCRD.Ref2, nPage, nCol, nRelBits );
                 // Sheet name of second corner is not displayed if identical
                 if (aCRD.Ref1.IsFlag3D() && aCRD.Ref1.Tab() == aCRD.Ref2.Tab() &&
@@ -368,7 +380,7 @@ ConvErr QProToSc::Convert( const ScTokenArray*& pArray )
         i++;
     }
     pArray = aPool[ aStack.Get() ];
-    return ConvErr::OK;
+    return eRet;
 }
 
 static const struct