[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-5.3' - 7 commits - include/oox oox/source sax/source sc/source solenv/gbuild starmath/source svtools/source vcl/source

Miklos Vajna vmiklos at collabora.co.uk
Mon Sep 18 20:25:59 UTC 2017


 include/oox/vml/vmlshapecontainer.hxx          |    8 +++---
 include/oox/vml/vmlshapecontext.hxx            |    9 ++++---
 oox/source/vml/vmlshapecontainer.cxx           |    4 +--
 oox/source/vml/vmlshapecontext.cxx             |   30 +++++++++++++++----------
 sax/source/expatwrap/xml2utf.cxx               |    8 ++----
 sc/source/ui/docshell/impex.cxx                |   20 ++++++++++++++++
 solenv/gbuild/platform/filter-showIncludes.awk |    7 +++++
 starmath/source/smdetect.cxx                   |    2 -
 svtools/source/svrtf/svparser.cxx              |    3 +-
 vcl/source/gdi/jobset.cxx                      |   22 ++++++++++++------
 10 files changed, 77 insertions(+), 36 deletions(-)

New commits:
commit 60d15ebbc75c224d016316c7a1a6acf93804d359
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Wed Jul 26 15:50:09 2017 +0200

    gbuild: strip away unexpected CR char at the end of Windows filenames
    
    As reported at e.g.
    <https://ask.libreoffice.org/en/question/90346/building-libreoffice-in-cygwin-leads-to-infinite-loop/>,
    sometimes MSVC (seen with 2013 on libreoffice-5-2, but there is no
    indication that 2015 on master would be different) emits CR characters
    at the end of filenames, resulting in unnecessary rebuilds at per-module
    builds, and actually to an infinite loop when doing toplevel make.
    
    Given that CR characters are unexpected in any filenames, it should be
    safe to just strip those away unconditionally.
    
    Change-Id: I3d56670b4d930a32489f889085711bfd436de82a
    Reviewed-on: https://gerrit.libreoffice.org/40452
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit e9b9a456221b4b0660f90efa1ee092ea00c2c728)

diff --git a/solenv/gbuild/platform/filter-showIncludes.awk b/solenv/gbuild/platform/filter-showIncludes.awk
index 6ec13e2fdb4c..3b19f34dc786 100755
--- a/solenv/gbuild/platform/filter-showIncludes.awk
+++ b/solenv/gbuild/platform/filter-showIncludes.awk
@@ -45,6 +45,13 @@ BEGIN {
     if (index($0, showincludes_prefix) == 1) {
         $0 = substr($0, length(showincludes_prefix) + 1)
         sub(/^ */, "")
+
+        # The output from MSVC may contain a carriage return character at the
+        # end of filenames, in which case the translation unit will depend on a
+        # non-existing header, resulting in constant rebuild of all files,
+        # prevent that.
+        sub(/
/, "")
+
         gsub(/\\/, "/")
         gsub(/ /, "\\ ")
         if ($0 ~ whitelist) { # filter out system headers
commit 1cfbe83729e8db88b7e20b383f3ff2de3581a2e0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Sep 17 17:38:39 2017 +0100

    detect corrupted job setup
    
    Change-Id: I0d3b4850c3d4c015a0a7e5d36d87113a749c7e0f
    Reviewed-on: https://gerrit.libreoffice.org/42385
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 1eb3822d74f535f75aa336b27568ee8a6084c4dd)

diff --git a/vcl/source/gdi/jobset.cxx b/vcl/source/gdi/jobset.cxx
index f80e246a5c68..31ee4f08dca5 100644
--- a/vcl/source/gdi/jobset.cxx
+++ b/vcl/source/gdi/jobset.cxx
@@ -239,7 +239,7 @@ SvStream& ReadJobSetup( SvStream& rIStream, JobSetup& rJobSetup )
 
         sal_uInt16 nSystem = 0;
         rIStream.ReadUInt16( nSystem );
-        const size_t nRead = nLen - sizeof(nLen) - sizeof(nSystem);
+        size_t nRead = nLen - sizeof(nLen) - sizeof(nSystem);
         if (nRead > rIStream.remainingSize())
         {
             SAL_WARN("vcl", "Parsing error: " << rIStream.remainingSize() <<
@@ -248,7 +248,7 @@ SvStream& ReadJobSetup( SvStream& rIStream, JobSetup& rJobSetup )
         }
         sal_uInt64 const nFirstPos = rIStream.Tell();
         std::unique_ptr<char[]> pTempBuf(new char[nRead]);
-        rIStream.ReadBytes(pTempBuf.get(), nRead);
+        nRead = rIStream.ReadBytes(pTempBuf.get(), nRead);
         if (nRead >= sizeof(ImplOldJobSetupData))
         {
             ImplOldJobSetupData* pData = reinterpret_cast<ImplOldJobSetupData*>(pTempBuf.get());
@@ -278,11 +278,19 @@ SvStream& ReadJobSetup( SvStream& rIStream, JobSetup& rJobSetup )
                 rJobData.SetPaperHeight( (long)SVBT32ToUInt32( pOldJobData->nPaperHeight ) );
                 if ( rJobData.GetDriverDataLen() )
                 {
-                    const sal_uInt8* pDriverData = reinterpret_cast<sal_uInt8*>(pOldJobData) + nOldJobDataSize;
-                    sal_uInt8* pNewDriverData = static_cast<sal_uInt8*>(
-                        rtl_allocateMemory( rJobData.GetDriverDataLen() ));
-                    memcpy( pNewDriverData, pDriverData, rJobData.GetDriverDataLen() );
-                    rJobData.SetDriverData( pNewDriverData );
+                    const char* pDriverData = reinterpret_cast<const char*>(pOldJobData) + nOldJobDataSize;
+                    const char* pDriverDataEnd = pDriverData + rJobData.GetDriverDataLen();
+                    if (pDriverDataEnd > pTempBuf.get() + nRead)
+                    {
+                        SAL_WARN("vcl", "corrupted job setup");
+                    }
+                    else
+                    {
+                        sal_uInt8* pNewDriverData = static_cast<sal_uInt8*>(
+                            rtl_allocateMemory( rJobData.GetDriverDataLen() ));
+                        memcpy( pNewDriverData, pDriverData, rJobData.GetDriverDataLen() );
+                        rJobData.SetDriverData( pNewDriverData );
+                    }
                 }
                 if( nSystem == JOBSET_FILE605_SYSTEM )
                 {
commit d72bff5dabc03b35e48f0eb7ca4ab18b2403af05
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Sep 17 14:22:45 2017 +0100

    valgrind: Conditional jump or move depends on uninitialised value
    
     Conditional jump or move depends on uninitialised value(s)
        at 0x4C3535E: strstr (vg_replace_strmem.c:1623)
        by 0x4FCD9E59: SmFilterDetect::detect(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>&) (smdetect.cxx:102)
        by 0x41A1A774: filter::config::TypeDetection::impl_askDetectService(rtl::OUString const&, utl::MediaDescriptor&) (typedetection.cxx:1038)
    
    Change-Id: I2f98fd3f7799f34cb5bd9242379ce6440645034d
    Reviewed-on: https://gerrit.libreoffice.org/42381
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 64aa36e8b999ea4dcad69904da941705effad618)
    Reviewed-on: https://gerrit.libreoffice.org/42387
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 256a405d4b1feeafd8a09e98bce9fb0c9125ee3d)

diff --git a/starmath/source/smdetect.cxx b/starmath/source/smdetect.cxx
index 18dfa736bd51..91c8733bf13c 100644
--- a/starmath/source/smdetect.cxx
+++ b/starmath/source/smdetect.cxx
@@ -93,12 +93,12 @@ OUString SAL_CALL SmFilterDetect::detect( Sequence< PropertyValue >& lDescriptor
         // stuff I hope?
         static const sal_uInt16 nBufferSize = 200;
         char aBuffer[nBufferSize+1];
-        aBuffer[nBufferSize] = 0;
         pInStrm->Seek( STREAM_SEEK_TO_BEGIN );
         pInStrm->StartReadingUnicodeText( RTL_TEXTENCODING_DONTKNOW ); // avoid BOM marker
         sal_uLong nBytesRead = pInStrm->ReadBytes( aBuffer, nBufferSize );
         if (nBytesRead >= 6)
         {
+            aBuffer[nBytesRead] = 0;
             bool bIsMathType = false;
             if (0 == strncmp( "<?xml", aBuffer, 5))
                 bIsMathType = (strstr( aBuffer, "<math>" ) ||
commit 253fe62c5b736bfd46106d510356e0809a44b02a
Author: Takeshi Abe <tabe at fixedpoint.jp>
Date:   Tue Jul 18 22:44:33 2017 +0900

    sax: Check if it starts with 5 bytes of "<?xml"
    
    Reviewed-on: https://gerrit.libreoffice.org/40139
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>
    (cherry picked from commit b64e564492220b34c14f069e8e1f42675bd9abe6)
    
    ofz: string has to be at least 5 chars long
    
    Reviewed-on: https://gerrit.libreoffice.org/42379
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    
    this should presumably be 5, rather than 4
    
    Change-Id: Iec5b748b188c7b1bf61e8137faf4b3f2d480d7f1
    98c50a59c03fc886d50362b9c5dd8c84f60e0b62
    20c6a6fb34485f42c2a828618e8918d8a441860a
    Reviewed-on: https://gerrit.libreoffice.org/42395
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Julien Nabet <serval2412 at yahoo.fr>
    
    (cherry picked from commit 44815f1439bb36e9fb5f0181c541fc4d0c9422f1)

diff --git a/sax/source/expatwrap/xml2utf.cxx b/sax/source/expatwrap/xml2utf.cxx
index 361e02fc99b0..017a3b1c96e9 100644
--- a/sax/source/expatwrap/xml2utf.cxx
+++ b/sax/source/expatwrap/xml2utf.cxx
@@ -126,7 +126,7 @@ XMLFile2UTFConverter::~XMLFile2UTFConverter()
 void XMLFile2UTFConverter::removeEncoding( Sequence<sal_Int8> &seq )
 {
     const sal_Int8 *pSource = seq.getArray();
-    if( ! strncmp( reinterpret_cast<const char *>(pSource), "<?xml", 4) )
+    if (seq.getLength() >= 5 && !strncmp(reinterpret_cast<const char *>(pSource), "<?xml", 5))
     {
 
         // scan for encoding
@@ -161,7 +161,6 @@ void XMLFile2UTFConverter::removeEncoding( Sequence<sal_Int8> &seq )
                                 &( seq.getArray()[nStop+1]) ,
                                 seq.getLength() - nStop -1);
                 seq.realloc( seq.getLength() - ( nStop+1 - nFound ) );
-//              str = String( (char * ) seq.getArray() , seq.getLen() );
             }
         }
     }
@@ -178,7 +177,7 @@ bool XMLFile2UTFConverter::isEncodingRecognizable( const Sequence< sal_Int8 > &s
         return false;
     }
 
-    if( ! strncmp( reinterpret_cast<const char *>(pSource), "<?xml", 4 ) ) {
+    if( ! strncmp( reinterpret_cast<const char *>(pSource), "<?xml", 5 ) ) {
         // scan if the <?xml tag finishes within this buffer
         bCheckIfFirstClosingBracketExsists = true;
     }
@@ -223,8 +222,7 @@ bool XMLFile2UTFConverter::scanForEncoding( Sequence< sal_Int8 > &seq )
     }
 
     // first level : detect possible file formats
-    if( ! strncmp( reinterpret_cast<const char *>(pSource), "<?xml", 4 ) ) {
-
+    if (seq.getLength() >= 5 && !strncmp(reinterpret_cast<const char *>(pSource), "<?xml", 5)) {
         // scan for encoding
         OString str( reinterpret_cast<const char *>(pSource), seq.getLength() );
 
commit fb7de575d2a308e9656bc83828045263dad87f9f
Author: Michael Stahl <mstahl at redhat.com>
Date:   Thu Sep 7 23:01:26 2017 +0200

    svtools: HTML import: don't put lone surrogates in OUString
    
    The bytes "ed b3 b5" in fdo67610-1.doc (which, as the name indicates,
    is an HTML file) are converted to the lone UTF-16 surrogate "dcf5",
    which is inserted into SwTextNode and causes asserts later on.
    
    The actual encoding of the HTML document is probably GBK (at least
    VIM doesn't display any missing characters with that), but
    because it doesn't contain any indication of its encoding
    it's apparently imported as UTF-8; the ImplConvertUtf8ToUnicode()
    thinking a surrogate code point is valid even if the Java-compatible
    mode RTL_TEXTENCODING_JAVA_UTF8 is not specified is a bit of a
    surprise.
    
    [note: the master commit says "JSON-compatible mode" but i was
     confusing different text encoding perversions there]
    
    Change-Id: Idd788d9d461fed150171dd907439166f3075a834
    (cherry picked from commit fc670f637d4271246691904fd649358ce2e7be59)
    Reviewed-on: https://gerrit.libreoffice.org/42101
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 756949c06b8bf933bcd13a226f449b8909cbf3ae)

diff --git a/svtools/source/svrtf/svparser.cxx b/svtools/source/svrtf/svparser.cxx
index 0540e172be10..ca4f389b83b5 100644
--- a/svtools/source/svrtf/svparser.cxx
+++ b/svtools/source/svrtf/svparser.cxx
@@ -390,7 +390,8 @@ sal_uInt32 SvParser::GetNextChar()
         while( 0 == nChars  && !bErr );
     }
 
-    if ( ! rtl::isUnicodeCodePoint( c ) )
+    // Note: ImplConvertUtf8ToUnicode() may produce a surrogate!
+    if (!rtl::isUnicodeCodePoint(c) || rtl::isHighSurrogate(c) || rtl::isLowSurrogate(c))
         c = (sal_uInt32) '?' ;
 
     if( bErr )
commit e56850ce7c66aed7e3b6b4b5b140e70e7becbb1c
Author: Michael Stahl <mstahl at redhat.com>
Date:   Wed Sep 13 10:48:38 2017 +0200

    tdf#112311 oox: fix UAF of std::shared_ptr
    
    OOXMLFastContextHandlerShape::sendShape() deletes the parent context's
    ShapeTypeContext::mrTypeModel.
    
    It looks like the sendShape() can't be delayed because writerfilter
    wants to import the v:textbox content into a text frame.
    
    Keep the shape alive until the end of the containing context.
    
    Not sure if it's going to process the v:fill element properly,
    but at lest valgrind is happy.
    
    (probably regression from CWS writerfilter32bugfixes01)
    
    Change-Id: Ifeab84751a1b20b2f272c4dd74b7097deb5eece0
    (cherry picked from commit 88c84e71e2559ec6d0b4f8c5101a149daa4a2b2b)
    Reviewed-on: https://gerrit.libreoffice.org/42245
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 7c7c19d80e6a6327be563a18febc3854d9a38daf)

diff --git a/include/oox/vml/vmlshapecontainer.hxx b/include/oox/vml/vmlshapecontainer.hxx
index 76e294fc279d..692beafad555 100644
--- a/include/oox/vml/vmlshapecontainer.hxx
+++ b/include/oox/vml/vmlshapecontainer.hxx
@@ -61,10 +61,10 @@ public:
     Drawing&     getDrawing() { return mrDrawing; }
 
     /** Creates and returns a new shape template object. */
-    ShapeType&          createShapeType();
+    std::shared_ptr<ShapeType> createShapeType();
     /** Creates and returns a new shape object of the specified type. */
     template< typename ShapeT >
-    ShapeT&             createShape();
+    std::shared_ptr<ShapeT> createShape();
 
     /** Final processing after import of the drawing fragment. */
     void                finalizeFragmentImport();
@@ -123,11 +123,11 @@ private:
 
 
 template< typename ShapeT >
-ShapeT& ShapeContainer::createShape()
+std::shared_ptr<ShapeT> ShapeContainer::createShape()
 {
     std::shared_ptr< ShapeT > xShape( new ShapeT( mrDrawing ) );
     maShapes.push_back( xShape );
-    return *xShape;
+    return xShape;
 }
 
 template< typename Functor >
diff --git a/include/oox/vml/vmlshapecontext.hxx b/include/oox/vml/vmlshapecontext.hxx
index 55a2ff70f9e2..aa2771302624 100644
--- a/include/oox/vml/vmlshapecontext.hxx
+++ b/include/oox/vml/vmlshapecontext.hxx
@@ -99,7 +99,7 @@ class ShapeTypeContext : public ShapeContextBase
 public:
     explicit            ShapeTypeContext(
                             ::oox::core::ContextHandler2Helper& rParent,
-                            ShapeType& rShapeType,
+                            std::shared_ptr<ShapeType> const& pShapeType,
                             const AttributeList& rAttribs );
 
     virtual ::oox::core::ContextHandlerRef
@@ -113,6 +113,7 @@ private:
     OptValue< OUString > decodeFragmentPath( const AttributeList& rAttribs, sal_Int32 nToken ) const;
 
 private:
+    std::shared_ptr<ShapeType> m_pShapeType;
     ShapeTypeModel&     mrTypeModel;
 };
 
@@ -122,7 +123,7 @@ class ShapeContext : public ShapeTypeContext
 public:
     explicit            ShapeContext(
                             ::oox::core::ContextHandler2Helper& rParent,
-                            ShapeBase& rShape,
+                            std::shared_ptr<ShapeBase> pShape,
                             const AttributeList& rAttribs );
 
     virtual ::oox::core::ContextHandlerRef
@@ -155,7 +156,7 @@ class GroupShapeContext : public ShapeContext
 public:
     explicit            GroupShapeContext(
                             ::oox::core::ContextHandler2Helper& rParent,
-                            GroupShape& rShape,
+                            std::shared_ptr<GroupShape> pShape,
                             const AttributeList& rAttribs );
 
     virtual ::oox::core::ContextHandlerRef
@@ -172,7 +173,7 @@ public:
     explicit            RectangleShapeContext(
                             ::oox::core::ContextHandler2Helper& rParent,
                             const AttributeList& rAttribs,
-                            RectangleShape& rShape );
+                            std::shared_ptr<RectangleShape> pShape);
 
     virtual ::oox::core::ContextHandlerRef
                         onCreateContext( sal_Int32 nElement, const AttributeList& rAttribs ) override;
diff --git a/oox/source/vml/vmlshapecontainer.cxx b/oox/source/vml/vmlshapecontainer.cxx
index 055365202d5d..31359f862fba 100644
--- a/oox/source/vml/vmlshapecontainer.cxx
+++ b/oox/source/vml/vmlshapecontainer.cxx
@@ -59,11 +59,11 @@ ShapeContainer::~ShapeContainer()
 {
 }
 
-ShapeType& ShapeContainer::createShapeType()
+std::shared_ptr<ShapeType> ShapeContainer::createShapeType()
 {
     std::shared_ptr< ShapeType > xShape( new ShapeType( mrDrawing ) );
     maTypes.push_back( xShape );
-    return *xShape;
+    return xShape;
 }
 
 void ShapeContainer::finalizeFragmentImport()
diff --git a/oox/source/vml/vmlshapecontext.cxx b/oox/source/vml/vmlshapecontext.cxx
index 800ec9ad0582..8f4170b40f49 100644
--- a/oox/source/vml/vmlshapecontext.cxx
+++ b/oox/source/vml/vmlshapecontext.cxx
@@ -269,9 +269,12 @@ ContextHandlerRef ShapeContextBase::createShapeContext( ContextHandler2Helper& r
     return nullptr;
 }
 
-ShapeTypeContext::ShapeTypeContext( ContextHandler2Helper& rParent, ShapeType& rShapeType, const AttributeList& rAttribs ) :
-    ShapeContextBase( rParent ),
-    mrTypeModel( rShapeType.getTypeModel() )
+ShapeTypeContext::ShapeTypeContext(ContextHandler2Helper& rParent,
+        std::shared_ptr<ShapeType> const& pShapeType,
+        const AttributeList& rAttribs)
+    : ShapeContextBase(rParent)
+    , m_pShapeType(pShapeType) // tdf#112311 keep it alive
+    , mrTypeModel( pShapeType->getTypeModel() )
 {
     // shape identifier and shape name
     bool bHasOspid = rAttribs.hasAttribute( O_TOKEN( spid ) );
@@ -442,10 +445,11 @@ void ShapeTypeContext::setStyle( const OUString& rStyle )
     }
 }
 
-ShapeContext::ShapeContext( ContextHandler2Helper& rParent, ShapeBase& rShape, const AttributeList& rAttribs ) :
-    ShapeTypeContext( rParent, rShape, rAttribs ),
-    mrShape( rShape ),
-    mrShapeModel( rShape.getShapeModel() )
+ShapeContext::ShapeContext(ContextHandler2Helper& rParent,
+        std::shared_ptr<ShapeBase> pShape, const AttributeList& rAttribs)
+    : ShapeTypeContext( rParent, pShape, rAttribs )
+    , mrShape( *pShape )
+    , mrShapeModel( pShape->getShapeModel() )
 {
     // collect shape specific attributes
     mrShapeModel.maType = rAttribs.getXString( XML_type, OUString() );
@@ -532,9 +536,10 @@ void ShapeContext::setVmlPath( const OUString& rPath )
         mrShapeModel.maVmlPath = rPath;
 }
 
-GroupShapeContext::GroupShapeContext( ContextHandler2Helper& rParent, GroupShape& rShape, const AttributeList& rAttribs ) :
-    ShapeContext( rParent, rShape, rAttribs ),
-    mrShapes( rShape.getChildren() )
+GroupShapeContext::GroupShapeContext(ContextHandler2Helper& rParent,
+        std::shared_ptr<GroupShape> pShape, const AttributeList& rAttribs)
+    : ShapeContext( rParent, pShape, rAttribs )
+    , mrShapes( pShape->getChildren() )
 {
 }
 
@@ -546,8 +551,9 @@ ContextHandlerRef GroupShapeContext::onCreateContext( sal_Int32 nElement, const
     return xContext.get() ? xContext : ShapeContext::onCreateContext( nElement, rAttribs );
 }
 
-RectangleShapeContext::RectangleShapeContext( ContextHandler2Helper& rParent, const AttributeList& rAttribs, RectangleShape& rShape ) :
-    ShapeContext( rParent, rShape, rAttribs )
+RectangleShapeContext::RectangleShapeContext(ContextHandler2Helper& rParent,
+        const AttributeList& rAttribs, std::shared_ptr<RectangleShape> pShape)
+    : ShapeContext( rParent, pShape, rAttribs )
 {
 }
 
commit d40fbcce428534f7777a57c05478f27cebab0c3f
Author: Eike Rathke <erack at redhat.com>
Date:   Thu Sep 14 14:30:08 2017 +0200

    ofz#3362 SYLK import: check ;X;Y;C;R col/row validity early
    
    Change-Id: I37d5ce67f975b6b89c4b8a9baefae2467da2eb84
    (cherry picked from commit 34ac0f9a0376b43bcff78a49ccaf4caa34c8c990)
    Reviewed-on: https://gerrit.libreoffice.org/42278
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit c759f30a5220dfd29894e34ee16c3fe2bf415592)

diff --git a/sc/source/ui/docshell/impex.cxx b/sc/source/ui/docshell/impex.cxx
index 0f0db15d30dc..7aa39d385a9c 100644
--- a/sc/source/ui/docshell/impex.cxx
+++ b/sc/source/ui/docshell/impex.cxx
@@ -1776,15 +1776,35 @@ bool ScImportExport::Sylk2Doc( SvStream& rStrm )
                     {
                         case 'X':
                             nCol = static_cast<SCCOL>(OUString(p).toInt32()) + nStartCol - 1;
+                            if (nCol < 0 || MAXCOL < nCol)
+                            {
+                                SAL_WARN("sc.ui","ScImportExport::Sylk2Doc - ;X invalid nCol=" << nCol);
+                                nCol = std::max<SCCOL>( 0, std::min<SCCOL>( nCol, MAXCOL));
+                            }
                             break;
                         case 'Y':
                             nRow = OUString(p).toInt32() + nStartRow - 1;
+                            if (nRow < 0 || MAXROW < nRow)
+                            {
+                                SAL_WARN("sc.ui","ScImportExport::Sylk2Doc - ;Y invalid nRow=" << nRow);
+                                nRow = std::max<SCROW>( 0, std::min<SCROW>( nRow, MAXROW));
+                            }
                             break;
                         case 'C':
                             nRefCol = static_cast<SCCOL>(OUString(p).toInt32()) + nStartCol - 1;
+                            if (nRefCol < 0 || MAXCOL < nRefCol)
+                            {
+                                SAL_WARN("sc.ui","ScImportExport::Sylk2Doc - ;C invalid nRefCol=" << nRefCol);
+                                nRefCol = std::max<SCCOL>( 0, std::min<SCCOL>( nRefCol, MAXCOL));
+                            }
                             break;
                         case 'R':
                             nRefRow = OUString(p).toInt32() + nStartRow - 1;
+                            if (nRefRow < 0 || MAXROW < nRefRow)
+                            {
+                                SAL_WARN("sc.ui","ScImportExport::Sylk2Doc - ;R invalid nRefRow=" << nRefRow);
+                                nRefRow = std::max<SCROW>( 0, std::min<SCROW>( nRefRow, MAXROW));
+                            }
                             break;
                         case 'K':
                         {


More information about the Libreoffice-commits mailing list