[Libreoffice-commits] core.git: Branch 'libreoffice-6-0' - sc/source

[Eike Rathke]

 sc/source/filter/qpro/qpro.cxx     |    5 ++++
 sc/source/filter/qpro/qproform.cxx |   39 ++++++++++++++++++++++++-------------
 2 files changed, 31 insertions(+), 13 deletions(-)

New commits:
commit 5b51f45bcbf5fb70b7e53d9deaf5663402f61b27
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Jan 31 18:00:15 2018 +0100

    ofz: do not force non-existent parameters into the TokenPool
    
     This is a combination of 4 commits.
    
    ofz: guard against binary crap argument counts and ID/OpCode generation
    
    Same as in sc/source/filter/lotus/lotform.cxx LotusToSc::DoFunc()
    
    (cherry picked from commit d2473faee119c35b518849afe3daa6977a751c68)
    
    ofz: do not force non-existent parameters into the TokenPool
    
    Apart from that, the hard coded storage order for ocRRI and ocIpmt
    did the same as the general loop, just with a fixed number of
    parameters. Instead, limit the number of arguments for the loop
    for these opcodes.
    
    (cherry picked from commit bc697917c79609243305dcecc7aeef2f3776611c)
    
    Author was too dumb to adjust a copy-pasta digit
    
    (cherry picked from commit 6fc7f3f8409040a3d977b944b3fa4151faf31301)
    
    Check for end-of-stream after reading formula headers
    
    (cherry picked from commit 1698425c6e2341835aef8c405c06482d4d78d73a)
    
    378ccaf60da61c1a385555451456d8422ee33c50
    7d171fdf21c02af9a14600c5e0c6294c0f3ebb57
    0de0ceeda63d733779aa595bdbd0f2be97827694
    
    Change-Id: I4972e065ab96abdea42d64481d4e30674230ab99
    Reviewed-on: https://gerrit.libreoffice.org/49120
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/source/filter/qpro/qpro.cxx b/sc/source/filter/qpro/qpro.cxx
index 0c1d18d59ffd..e7e2a6d17d27 100644
--- a/sc/source/filter/qpro/qpro.cxx
+++ b/sc/source/filter/qpro/qpro.cxx
@@ -101,6 +101,11 @@ ErrCode ScQProReader::readSheet( SCTAB nTab, ScDocument* pDoc, ScQProStyle *pSty
                 double nValue;
                 sal_uInt16 nState, nLen;
                 mpStream->ReadUChar( nCol ).ReadUChar( nDummy ).ReadUInt16( nRow ).ReadUInt16( nStyle ).ReadDouble( nValue ).ReadUInt16( nState ).ReadUInt16( nLen );
+                if (!mpStream->good())
+                {
+                    eRet = SCERR_IMPORT_FORMAT;
+                    break;
+                }
                 ScAddress aAddr( nCol, nRow, nTab );
                 const ScTokenArray *pArray;
 
diff --git a/sc/source/filter/qpro/qproform.cxx b/sc/source/filter/qpro/qproform.cxx
index 73da364969c9..e4a83bcee6e4 100644
--- a/sc/source/filter/qpro/qproform.cxx
+++ b/sc/source/filter/qpro/qproform.cxx
@@ -94,8 +94,12 @@ void QProToSc::DoFunc( DefTokenId eOc, sal_uInt16 nArgs, const sal_Char* pExtStr
 
     if( nArgs < nBufSize )
     {
-        for( nCount = 0; nCount < nArgs ; nCount++ )
+        for( nCount = 0; nCount < nArgs && aStack.HasMoreTokens() ; nCount++ )
             aStack >> eParam[ nCount ];
+
+        if (nCount < nArgs)
+            // Adapt count to reality. All sort of binary crap is possible.
+            nArgs = static_cast<sal_uInt16>(nCount);
     }
     else
         return;
@@ -132,20 +136,29 @@ void QProToSc::DoFunc( DefTokenId eOc, sal_uInt16 nArgs, const sal_Char* pExtStr
 
     if( nArgs> 0 )
     {
-        sal_Int16 nLast = nArgs- 1;
-
         if( eOc == ocRRI )
-            aPool << eParam[ 2 ] << ocSep << eParam[ 1 ] << ocSep << eParam[ 0 ];
-        if( eOc == ocIpmt )
-            aPool << eParam[ 3 ] << ocSep << eParam[ 2 ] << ocSep << eParam[ 1 ] << ocSep << eParam[ 0 ];
-        else
         {
-            aPool << eParam[ nLast ];
-            for( nCount = nLast - 1 ; nCount >= 0 ; nCount-- )
-            {
-                if( nCount != -1 )
-                    aPool << ocSep << eParam[ nCount ];
-            }
+            // There should be at least 3 arguments, but with binary crap may not..
+            SAL_WARN_IF( nArgs < 3, "sc.filter","QProToSc::DoFunc - ocRRI expects 3 parameters but got " << nArgs);
+            // Store first 3 parameters to pool in order 2,1,0
+            if (nArgs > 3)
+                nArgs = 3;
+        }
+        else if( eOc == ocIpmt )
+        {
+            // There should be at least 4 arguments, but with binary crap may not..
+            SAL_WARN_IF( nArgs < 4, "sc.filter","QProToSc::DoFunc - ocIpmt expects 4 parameters but got " << nArgs);
+            // Store first 4 parameters to pool in order 3,2,1,0
+            if (nArgs > 4)
+                nArgs = 4;
+        }
+
+        sal_Int16 nLast = nArgs - 1;
+        aPool << eParam[ nLast ];
+        for( nCount = nLast - 1 ; nCount >= 0 ; nCount-- )
+        {
+            if( nCount != -1 )
+                aPool << ocSep << eParam[ nCount ];
         }
     }