|
 |
228e4d |
From 0ef6d568922ea3ff852310e87f813074d3029e88 Mon Sep 17 00:00:00 2001
|
|
|
228e4d |
From: Eike Rathke <erack@redhat.com>
|
|
|
228e4d |
Date: Fri, 17 Feb 2023 12:03:54 +0100
|
|
|
228e4d |
Subject: [PATCH] Stack check safety belt before fishing in muddy waters
|
|
|
228e4d |
MIME-Version: 1.0
|
|
|
228e4d |
Content-Type: text/plain; charset=UTF-8
|
|
|
228e4d |
Content-Transfer-Encoding: 8bit
|
|
|
228e4d |
|
|
|
228e4d |
Have it hit hard in debug builds.
|
|
|
228e4d |
|
|
|
228e4d |
Change-Id: I9ea54844a0661fd7a75616a2876983a74b2d5bad
|
|
|
228e4d |
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147205
|
|
|
228e4d |
Reviewed-by: Eike Rathke <erack@redhat.com>
|
|
|
228e4d |
Tested-by: Jenkins
|
|
|
228e4d |
(cherry picked from commit 9d91fbba6f374fa1c10b38eae003da89bd4e6d4b)
|
|
|
228e4d |
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147245
|
|
|
228e4d |
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
|
|
|
228e4d |
(cherry picked from commit 166a07062dd4ffedca6106f439a6fcddaeee5eb5)
|
|
|
228e4d |
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147391
|
|
|
228e4d |
Tested-by: Michael Stahl <michael.stahl@allotropia.de>
|
|
|
228e4d |
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
|
|
|
228e4d |
(cherry picked from commit f8efb098f2abbf054a15dcf7daaaacfa575685ae)
|
|
|
228e4d |
|
|
|
228e4d |
erAck: backported to 5.3.6.1
|
|
|
228e4d |
---
|
|
|
228e4d |
sc/source/core/inc/interpre.hxx | 12 ++++++++++++
|
|
|
228e4d |
sc/source/core/tool/interpr1.cxx | 4 ++--
|
|
|
228e4d |
2 files changed, 14 insertions(+), 2 deletions(-)
|
|
|
228e4d |
|
|
|
228e4d |
diff --git a/sc/source/core/inc/interpre.hxx b/sc/source/core/inc/interpre.hxx
|
|
|
228e4d |
index 636f2ec..934b253 100644
|
|
|
228e4d |
--- a/sc/source/core/inc/interpre.hxx
|
|
|
228e4d |
+++ b/sc/source/core/inc/interpre.hxx
|
|
|
228e4d |
@@ -220,6 +220,7 @@ private:
|
|
|
228e4d |
inline bool MustHaveParamCount( short nAct, short nMust );
|
|
|
228e4d |
inline bool MustHaveParamCount( short nAct, short nMust, short nMax );
|
|
|
228e4d |
inline bool MustHaveParamCountMin( short nAct, short nMin );
|
|
|
228e4d |
+inline bool MustHaveParamCountMinWithStackCheck( short nAct, short nMin );
|
|
|
228e4d |
void PushParameterExpected();
|
|
|
228e4d |
void PushIllegalParameter();
|
|
|
228e4d |
void PushIllegalArgument();
|
|
|
228e4d |
@@ -1032,6 +1033,17 @@ inline bool ScInterpreter::MustHaveParamCountMin( short nAct, short nMin )
|
|
|
228e4d |
return false;
|
|
|
228e4d |
}
|
|
|
228e4d |
|
|
|
228e4d |
+inline bool ScInterpreter::MustHaveParamCountMinWithStackCheck( short nAct, short nMin )
|
|
|
228e4d |
+{
|
|
|
228e4d |
+ assert(sp >= nAct);
|
|
|
228e4d |
+ if (sp < nAct)
|
|
|
228e4d |
+ {
|
|
|
228e4d |
+ PushParameterExpected();
|
|
|
228e4d |
+ return false;
|
|
|
228e4d |
+ }
|
|
|
228e4d |
+ return MustHaveParamCountMin( nAct, nMin);
|
|
|
228e4d |
+}
|
|
|
228e4d |
+
|
|
|
228e4d |
inline bool ScInterpreter::CheckStringPositionArgument( double & fVal )
|
|
|
228e4d |
{
|
|
|
228e4d |
if (!rtl::math::isFinite( fVal))
|
|
|
228e4d |
diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
|
|
|
228e4d |
index 22ae915..002f6ca 100644
|
|
|
228e4d |
--- a/sc/source/core/tool/interpr1.cxx
|
|
|
228e4d |
+++ b/sc/source/core/tool/interpr1.cxx
|
|
|
228e4d |
@@ -6659,7 +6659,7 @@ void ScInterpreter::ScVLookup()
|
|
|
228e4d |
void ScInterpreter::ScSubTotal()
|
|
|
228e4d |
{
|
|
|
228e4d |
sal_uInt8 nParamCount = GetByte();
|
|
|
228e4d |
- if ( MustHaveParamCountMin( nParamCount, 2 ) )
|
|
|
228e4d |
+ if ( MustHaveParamCountMinWithStackCheck( nParamCount, 2 ) )
|
|
|
228e4d |
{
|
|
|
228e4d |
// We must fish the 1st parameter deep from the stack! And push it on top.
|
|
|
228e4d |
const FormulaToken* p = pStack[ sp - nParamCount ];
|
|
|
228e4d |
@@ -6706,7 +6706,7 @@ void ScInterpreter::ScSubTotal()
|
|
|
228e4d |
void ScInterpreter::ScAggregate()
|
|
|
228e4d |
{
|
|
|
228e4d |
sal_uInt8 nParamCount = GetByte();
|
|
|
228e4d |
- if ( MustHaveParamCountMin( nParamCount, 3 ) )
|
|
|
228e4d |
+ if ( MustHaveParamCountMinWithStackCheck( nParamCount, 3 ) )
|
|
|
228e4d |
{
|
|
|
228e4d |
// fish the 1st parameter from the stack and push it on top.
|
|
|
228e4d |
const FormulaToken* p = pStack[ sp - nParamCount ];
|
|
|
228e4d |
--
|
|
|
228e4d |
2.44.0
|
|
|
228e4d |
|