core.git: 2 commits - sc/source

[Caolán McNamara (via logerrit)]

 sc/source/filter/html/htmlpars.cxx |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

New commits:
commit 11e98a5087f39eb8ff6a0b8ce260169f213e7c67
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Apr 8 22:07:11 2024 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Tue Apr 9 08:38:34 2024 +0200

    ofz#67906 Integer-overflow
    
    Change-Id: I459bdeef6bb7577c5388202374c981c7b01fa137
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165899
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sc/source/filter/html/htmlpars.cxx 
b/sc/source/filter/html/htmlpars.cxx
index 4745be3526dd..83d9c01fbf7e 100644
--- a/sc/source/filter/html/htmlpars.cxx
+++ b/sc/source/filter/html/htmlpars.cxx
@@ -1058,7 +1058,7 @@ void ScHTMLLayoutParser::TableDataOn( HtmlImportInfo* 
pInfo )
             case HtmlOptionId::COLSPAN:
             {
                 sal_Int32 nColOverlap = rOption.GetString().toInt32();
-                if (nColOverlap >= 0 && nColOverlap <= SCCOL_MAX)
+                if (nColOverlap >= 0 && nColOverlap <= mpDoc->MaxCol())
                     mxActEntry->nColOverlap = static_cast<SCCOL>(nColOverlap);
                 else
                     SAL_WARN("sc", "ScHTMLLayoutParser::TableDataOn ignoring 
colspan: " << nColOverlap);
@@ -1067,7 +1067,7 @@ void ScHTMLLayoutParser::TableDataOn( HtmlImportInfo* 
pInfo )
             case HtmlOptionId::ROWSPAN:
             {
                 sal_Int32 nRowOverlap = rOption.GetString().toInt32();
-                if (nRowOverlap >= 0)
+                if (nRowOverlap >= 0 && nRowOverlap <= mpDoc->MaxRow())
                     mxActEntry->nRowOverlap = static_cast<SCROW>(nRowOverlap);
                 else
                     SAL_WARN("sc", "ScHTMLLayoutParser::TableDataOn ignoring 
rowspan: " << nRowOverlap);
commit 8527dc74eb1adc9fe4c25134ec853a83d46f1089
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Apr 8 21:59:41 2024 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Tue Apr 9 08:38:23 2024 +0200

    ofz#67904 Integer-overflow
    
    Change-Id: I27f4126fe0109611f6fdb486ed7f9ee3067ebcb1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165898
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sc/source/filter/html/htmlpars.cxx 
b/sc/source/filter/html/htmlpars.cxx
index 49e86d7ce1b2..4745be3526dd 100644
--- a/sc/source/filter/html/htmlpars.cxx
+++ b/sc/source/filter/html/htmlpars.cxx
@@ -541,7 +541,7 @@ void ScHTMLLayoutParser::SkipLocked( ScEEParseEntry* pE, 
bool bJoin )
     bool bFail = o3tl::checked_add<SCCOL>(pE->nCol, pE->nColOverlap - 1, 
nEndCol) ||
                  o3tl::checked_add<SCROW>(pE->nRow, pE->nRowOverlap - 1, 
nEndRow);
 
-    if (bFail)
+    if (bFail || nEndRow > mpDoc->MaxRow())
     {
         SAL_WARN("sc", "invalid range: " << pE->nCol << " " << pE->nColOverlap 
<<
                                      " " << pE->nRow << " " << 
pE->nRowOverlap);