[Libreoffice-commits] core.git: sc/source

[Stephan Bergmann (via logerrit)]

 sc/source/filter/excel/impop.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 556832332ce2e26ec727d6dffebefe53786f84cd
Author:     Stephan Bergmann <sbergman at redhat.com>
AuthorDate: Thu Oct 17 15:06:44 2019 +0200
Commit:     Stephan Bergmann <sbergman at redhat.com>
CommitDate: Thu Oct 17 15:54:46 2019 +0200

    Don't use uninitialized memory when reading from the stream fails
    
    Valgrind'ing CppunitTest_sc_filters_test failed with
    
    > Conditional jump or move depends on uninitialised value(s)
    >    at 0x21175CE0: XclRange::GetColCount() const (/sc/source/filter/inc/xladdress.hxx:73)
    >    by 0x2117048D: ImportExcel::ReadDimensions() (/sc/source/filter/excel/impop.cxx:248)
    >    by 0x21188E78: ImportExcel8::Read() (/sc/source/filter/excel/read.cxx:1108)
    >    by 0x21123C3F: ScFormatFilterPluginImpl::ScImportExcel(SfxMedium&, ScDocument*, EXCIMPFORMAT) (/sc/source/filter/excel/excel.cxx:137)
    [...]
    
    when loading sc/qa/unit/data/xls/pass/CVE-2006-3086-1.xls.
    
    As there appears to be no error-handling concept in ImportExcel::ReadDimensions,
    at least zero-initialize the relevant variables.
    
    Change-Id: I11dbd2a1032ecc723f65a563ef022d7eb3c970ff
    Reviewed-on: https://gerrit.libreoffice.org/80948
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sbergman at redhat.com>

diff --git a/sc/source/filter/excel/impop.cxx b/sc/source/filter/excel/impop.cxx
index 1bebd26143bf..03c6c73706f4 100644
--- a/sc/source/filter/excel/impop.cxx
+++ b/sc/source/filter/excel/impop.cxx
@@ -222,7 +222,7 @@ sal_uInt16 ImportExcel::ReadXFIndex( const ScAddress& rScPos, bool bBiff2 )
 
 void ImportExcel::ReadDimensions()
 {
-    XclRange aXclUsedArea( ScAddress::UNINITIALIZED );
+    XclRange aXclUsedArea;
     if( (maStrm.GetRecId() == EXC_ID2_DIMENSIONS) || (GetBiff() <= EXC_BIFF5) )
     {
         maStrm >> aXclUsedArea;
@@ -240,7 +240,7 @@ void ImportExcel::ReadDimensions()
     }
     else
     {
-        sal_uInt32 nXclRow1, nXclRow2;
+        sal_uInt32 nXclRow1 = 0, nXclRow2 = 0;
         nXclRow1 = maStrm.ReaduInt32();
         nXclRow2 = maStrm.ReaduInt32();
         aXclUsedArea.maFirst.mnCol = maStrm.ReaduInt16();