formula/source/core/api/FormulaCompiler.cxx | 8 ++++++-- include/formula/FormulaCompiler.hxx | 1 + 2 files changed, 7 insertions(+), 2 deletions(-)
New commits: commit c2348bbbbd960e29087f0578244f3be7f4df4c8c Author: Eike Rathke <er...@redhat.com> Date: Tue Jul 4 15:22:23 2017 +0200 Set error on more than max params (255) per function Parameter count is size byte, so.. SUM(1,1,1,...) with 256 arguments resulted in 0 (uint8 wrapping around). (cherry picked from commit 209cc5c211260a6c20cc6fb5ac02fd5a88100314) Change-Id: Ib9997ad0d0d13d4c5171f276148b6c5cad570d5b Reviewed-on: https://gerrit.libreoffice.org/39505 Tested-by: Jenkins <c...@libreoffice.org> Reviewed-by: Markus Mohrhard <markus.mohrh...@googlemail.com> diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx index b626039efed7..037d2fb745b0 100644 --- a/formula/source/core/api/FormulaCompiler.cxx +++ b/formula/source/core/api/FormulaCompiler.cxx @@ -1493,7 +1493,7 @@ void FormulaCompiler::Factor() } else SetError( FormulaError::PairExpected); - sal_uInt8 nSepCount = 0; + sal_uInt32 nSepCount = 0; const sal_uInt16 nSepPos = pArr->nIndex - 1; // separator position, if any if( !bNoParam ) { @@ -1503,6 +1503,8 @@ void FormulaCompiler::Factor() NextToken(); CheckSetForceArrayParameter( mpToken, nSepCount); nSepCount++; + if (nSepCount > FORMULA_MAXPARAMS) + SetError( FormulaError::CodeOverflow); eOp = Expression(); } } @@ -1599,7 +1601,7 @@ void FormulaCompiler::Factor() } else SetError( FormulaError::PairExpected); - sal_uInt8 nSepCount = 0; + sal_uInt32 nSepCount = 0; if( !bNoParam ) { nSepCount++; @@ -1608,6 +1610,8 @@ void FormulaCompiler::Factor() NextToken(); CheckSetForceArrayParameter( mpToken, nSepCount); nSepCount++; + if (nSepCount > FORMULA_MAXPARAMS) + SetError( FormulaError::CodeOverflow); eOp = Expression(); } } diff --git a/include/formula/FormulaCompiler.hxx b/include/formula/FormulaCompiler.hxx index f6650201bba1..f105250181fc 100644 --- a/include/formula/FormulaCompiler.hxx +++ b/include/formula/FormulaCompiler.hxx @@ -39,6 +39,7 @@ #define FORMULA_MAXJUMPCOUNT 32 /* maximum number of jumps (ocChoose) */ #define FORMULA_MAXTOKENS 8192 /* maximum number of tokens in formula */ +#define FORMULA_MAXPARAMS 255 /* maximum number of parameters per function (byte) */ namespace com { namespace sun { namespace star { _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits