diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2021-04-02 14:28:37 +0100 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2021-11-17 19:19:34 +0100 |
| commit | 83e5a2bd1d8250e067f03f1ac54d74c851be2eed (patch) | |
| tree | 960442b1325f8eea218d7419cf4d49b3a937efc6 | |
| parent | crashtesting: crash on reexport of tdf118346-1.odg to odg (diff) | |
| download | core-83e5a2bd1d8250e067f03f1ac54d74c851be2eed.tar.gz core-83e5a2bd1d8250e067f03f1ac54d74c851be2eed.zip | |
ofz: Segv on unknown address
Change-Id: I6c69375a89781fc0b87230203335c861efb562f9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113518
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 8de38977838d5a044271cb170730e3d557659f17)
| -rw-r--r-- | sc/source/core/tool/compiler.cxx | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx index 70554ae93861..b307bc6dea12 100644 --- a/sc/source/core/tool/compiler.cxx +++ b/sc/source/core/tool/compiler.cxx @@ -2532,7 +2532,14 @@ Label_MaskStateMachine: if (eState != ssSkipReference) { *pSym++ = c; - *pSym++ = *pSrc++; + + if( pSym == &cSymbol[ MAXSTRLEN ] ) + { + SetError( FormulaError::StringOverflow); + eState = ssStop; + } + else + *pSym++ = *pSrc++; } bAddToSymbol = false; } |