[Libreoffice-commits] core.git: sc/source

[Caolán McNamara (via logerrit)]

 sc/source/filter/excel/xltoolbar.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 5b462dff91209896e9f3d120b6dcdab85a6f1394
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Mar 26 16:38:02 2021 +0000
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Mar 26 20:40:49 2021 +0100

    cid#1242796 Untrusted loop bound
    
    Change-Id: I04e5df04747b764d4bfe035662b07a450ae0e5c7
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113168
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/source/filter/excel/xltoolbar.cxx b/sc/source/filter/excel/xltoolbar.cxx
index 87f22f630843..7b4e40482a54 100644
--- a/sc/source/filter/excel/xltoolbar.cxx
+++ b/sc/source/filter/excel/xltoolbar.cxx
@@ -8,6 +8,7 @@
  */
 #include "xltoolbar.hxx"
 #include <sal/log.hxx>
+#include <o3tl/safeint.hxx>
 #include <com/sun/star/beans/XPropertySet.hpp>
 #include <com/sun/star/document/IndexedPropertyValues.hpp>
 #include <com/sun/star/ui/XUIConfigurationPersistence.hpp>
@@ -346,7 +347,7 @@ ScCTBWrapper::Read( SvStream &rS)
 
     //ScCTB is 1 TB which is min 15bytes, nViews TBVisualData which is min 20bytes
     //and one 32bit number (4 bytes)
-    const size_t nMinRecordSize = 19 + ctbSet.ctbViews * 20;
+    const size_t nMinRecordSize = 19 + o3tl::sanitizing_min(ctbSet.ctbViews * 20, 0);
     const size_t nMaxPossibleRecords = rS.remainingSize()/nMinRecordSize;
     if (ctbSet.ctb > nMaxPossibleRecords)
         return false;