[Libreoffice-commits] core.git: sc/source

[Caolán McNamara (via logerrit)]

 sc/source/filter/excel/xistring.cxx |   11 +++++++++++
 sc/source/filter/inc/xistream.hxx   |    4 ++++
 2 files changed, 15 insertions(+)

New commits:
commit 03fe7f500f2ccfa5e6a41ad1c9b6b1d7d4403887
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Nov 17 19:30:32 2019 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Tue Nov 19 22:16:50 2019 +0100

    cid#1448453 Untrusted value as argument
    
    Change-Id: I41a2f30df22b54e51acb593f340cb1ecf1c497b6
    Reviewed-on: https://gerrit.libreoffice.org/83037
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/source/filter/excel/xistring.cxx b/sc/source/filter/excel/xistring.cxx
index 096507ba8351..80b2e5140c21 100644
--- a/sc/source/filter/excel/xistring.cxx
+++ b/sc/source/filter/excel/xistring.cxx
@@ -113,6 +113,17 @@ void XclImpString::ReadFormats( XclImpStream& rStrm, XclFormatRunVec& rFormats )
 void XclImpString::ReadFormats( XclImpStream& rStrm, XclFormatRunVec& rFormats, sal_uInt16 nRunCount )
 {
     rFormats.clear();
+
+    size_t nElementSize = rStrm.GetRoot().GetBiff() == EXC_BIFF8 ? 4 : 2;
+    size_t nAvailableBytes = rStrm.GetRecLeft();
+    size_t nMaxElements = nAvailableBytes / nElementSize;
+    if (nRunCount > nMaxElements)
+    {
+        SAL_WARN("sc.filter", "XclImpString::ReadFormats - more formats claimed than stream could contain");
+        rStrm.SetSvStreamError(SVSTREAM_FILEFORMAT_ERROR);
+        return;
+    }
+
     rFormats.reserve( nRunCount );
     /*  #i33341# real life -- same character index may occur several times
         -> use AppendFormat() to validate formats */
diff --git a/sc/source/filter/inc/xistream.hxx b/sc/source/filter/inc/xistream.hxx
index 15cde8c9a911..855ff2c3219c 100644
--- a/sc/source/filter/inc/xistream.hxx
+++ b/sc/source/filter/inc/xistream.hxx
@@ -466,6 +466,10 @@ public:
     /** Restores stream position contained in rPos. */
     void                RestorePosition( const XclImpStreamPos& rPos );
 
+    /** Set an SVSTREAM_..._ERROR. */
+    void                SetSvStreamError( const ErrCode& rErrCode )
+                            { mrStrm.SetError( rErrCode ); }
+
 private:
     /** Seeks to next raw record header and reads record ID and size.
         @descr  This is a "raw" function, means that stream members are