[Libreoffice-commits] core.git: sc/source

[Caolán McNamara (via logerrit)]

 sc/source/filter/excel/excform8.cxx |    7 +++++++
 1 file changed, 7 insertions(+)

New commits:
commit 70b11d8ee1c93d1a31746086b858216a7d1cca7a
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Jul 20 15:06:13 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sat Jul 20 17:40:08 2019 +0200

    cid#1448265 Untrusted value as argument
    
    Change-Id: I31280f417e3542bb7596bab798e971b714b5285f
    Reviewed-on: https://gerrit.libreoffice.org/76002
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/source/filter/excel/excform8.cxx b/sc/source/filter/excel/excform8.cxx
index 7965c1a55c02..4ac2697093f0 100644
--- a/sc/source/filter/excel/excform8.cxx
+++ b/sc/source/filter/excel/excform8.cxx
@@ -1382,6 +1382,13 @@ void ExcelToSc8::ConvertExternName( std::unique_ptr<ScTokenArray>& rpArray, XclI
                 nRow2 = rStrm.ReaduInt16();
                 nGrbitCol1 = rStrm.ReaduInt16();
                 nGrbitCol2 = rStrm.ReaduInt16();
+
+                if (nExtTab1 >= nTabCount || nExtTab2 >= nTabCount)
+                {
+                    bError = true;
+                    break;
+                }
+
                 ScSingleRefData& rR1 = aCRD.Ref1;
                 ScSingleRefData& rR2 = aCRD.Ref2;