sc/source/core/inc/interpre.hxx | 12 ++++++++++++ sc/source/core/tool/interpr1.cxx | 4 ++-- 2 files changed, 14 insertions(+), 2 deletions(-)
New commits: commit cf43a5ca4c00648a29bc70ef4d3a8039466f3a8f Author: Eike Rathke <er...@redhat.com> AuthorDate: Fri Feb 17 12:03:54 2023 +0100 Commit: Caolán McNamara <caol...@redhat.com> CommitDate: Fri Feb 17 19:39:35 2023 +0000 Stack check safety belt before fishing in muddy waters Have it hit hard in debug builds. Change-Id: I9ea54844a0661fd7a75616a2876983a74b2d5bad Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147205 Reviewed-by: Eike Rathke <er...@redhat.com> Tested-by: Jenkins (cherry picked from commit 9d91fbba6f374fa1c10b38eae003da89bd4e6d4b) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147244 Reviewed-by: Caolán McNamara <caol...@redhat.com> diff --git a/sc/source/core/inc/interpre.hxx b/sc/source/core/inc/interpre.hxx index 85d2955003af..a6bd98320f71 100644 --- a/sc/source/core/inc/interpre.hxx +++ b/sc/source/core/inc/interpre.hxx @@ -221,6 +221,7 @@ private: inline bool MustHaveParamCount( short nAct, short nMust ); inline bool MustHaveParamCount( short nAct, short nMust, short nMax ); inline bool MustHaveParamCountMin( short nAct, short nMin ); + inline bool MustHaveParamCountMinWithStackCheck( short nAct, short nMin ); void PushParameterExpected(); void PushIllegalParameter(); void PushIllegalArgument(); @@ -1074,6 +1075,17 @@ inline bool ScInterpreter::MustHaveParamCountMin( short nAct, short nMin ) return false; } +inline bool ScInterpreter::MustHaveParamCountMinWithStackCheck( short nAct, short nMin ) +{ + assert(sp >= nAct); + if (sp < nAct) + { + PushParameterExpected(); + return false; + } + return MustHaveParamCountMin( nAct, nMin); +} + inline bool ScInterpreter::CheckStringPositionArgument( double & fVal ) { if (!std::isfinite( fVal)) diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx index d82acb37494c..405d9fe00023 100644 --- a/sc/source/core/tool/interpr1.cxx +++ b/sc/source/core/tool/interpr1.cxx @@ -7643,7 +7643,7 @@ void ScInterpreter::ScVLookup() void ScInterpreter::ScSubTotal() { sal_uInt8 nParamCount = GetByte(); - if ( !MustHaveParamCountMin( nParamCount, 2 ) ) + if ( !MustHaveParamCountMinWithStackCheck( nParamCount, 2 ) ) return; // We must fish the 1st parameter deep from the stack! And push it on top. @@ -7690,7 +7690,7 @@ void ScInterpreter::ScSubTotal() void ScInterpreter::ScAggregate() { sal_uInt8 nParamCount = GetByte(); - if ( !MustHaveParamCountMin( nParamCount, 3 ) ) + if ( !MustHaveParamCountMinWithStackCheck( nParamCount, 3 ) ) return; const FormulaError nErr = nGlobalError;