[Libreoffice-commits] core.git: sc/source

[Eike Rathke]

 sc/source/filter/qpro/qproform.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit d2473faee119c35b518849afe3daa6977a751c68
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Jan 31 18:00:15 2018 +0100

    ofz: guard against binary crap argument counts and ID/OpCode generation
    
    Same as in sc/source/filter/lotus/lotform.cxx LotusToSc::DoFunc()
    
    Change-Id: I4972e065ab96abdea42d64481d4e30674230ab99

diff --git a/sc/source/filter/qpro/qproform.cxx b/sc/source/filter/qpro/qproform.cxx
index 6a2a22c1be95..6555a7842037 100644
--- a/sc/source/filter/qpro/qproform.cxx
+++ b/sc/source/filter/qpro/qproform.cxx
@@ -94,8 +94,12 @@ void QProToSc::DoFunc( DefTokenId eOc, sal_uInt16 nArgs, const sal_Char* pExtStr
 
     if( nArgs < nBufSize )
     {
-        for( nCount = 0; nCount < nArgs ; nCount++ )
+        for( nCount = 0; nCount < nArgs && aStack.HasMoreTokens() ; nCount++ )
             aStack >> eParam[ nCount ];
+
+        if (nCount < nArgs)
+            // Adapt count to reality. All sort of binary crap is possible.
+            nArgs = static_cast<sal_uInt16>(nCount);
     }
     else
         return;