filter review QuattroPro

Patch by: Eike Rathke

sc/source/filter/ftools/ftools.cxx

@@ -274,12 +274,16 @@ ByteString ScfTools::ReadCString( SvStream& rStrm )
     ByteString aRet;
     sal_Char cChar;
 
+    sal_uInt32 nLen = 0;
     rStrm >> cChar;
-    while( cChar )
+    while( cChar && nLen++ < STRING_MAXLEN )
     {
         aRet += cChar;
         rStrm >> cChar;
     }
+    // Callers assume that a 0-byte was read and may advance their book keeping
+    // counters by String.Len()+1, don't put back cChar!=0 if STRING_MAXLEN was
+    // reached.
     return aRet;
 }
 
@@ -288,9 +292,10 @@ ByteString ScfTools::ReadCString( SvStream& rStrm, sal_Int32& rnBytesLeft )
     ByteString aRet;
     sal_Char cChar;
 
+    sal_uInt32 nLen = 0;
     rStrm >> cChar;
     rnBytesLeft--;
-    while( cChar )
+    while( cChar && nLen++ < STRING_MAXLEN )
     {
         aRet += cChar;
         rStrm >> cChar;
@@ -300,12 +305,12 @@ ByteString ScfTools::ReadCString( SvStream& rStrm, sal_Int32& rnBytesLeft )
     return aRet;
 }
 
-void ScfTools::AppendCString( SvStream& rStrm, ByteString& rString )
+void ScfTools::AppendCStringWithLen( SvStream& rStrm, ByteString& rString, sal_uInt32 nLen )
 {
     sal_Char cChar;
 
     rStrm >> cChar;
-    while( cChar )
+    while( cChar && nLen++ < STRING_MAXLEN )
     {
         rString += cChar;
         rStrm >> cChar;
@@ -315,7 +320,7 @@ void ScfTools::AppendCString( SvStream& rStrm, ByteString& rString )
 void ScfTools::AppendCString( SvStream& rStrm, String& rString, rtl_TextEncoding eTextEnc )
 {
     ByteString aByteString;
-    AppendCString( rStrm, aByteString );
+    AppendCStringWithLen( rStrm, aByteString, rString.Len() );
     rString += String( aByteString, eTextEnc );
 }
 

sc/source/filter/inc/ftools.hxx

@@ -359,8 +359,13 @@ public:
     inline static String ReadCString( SvStream& rStrm, sal_Int32& rnBytesLeft, rtl_TextEncoding eTextEnc )
                             { return String( ReadCString( rStrm, rnBytesLeft ), eTextEnc ); }
 
-    /** Appends a zero terminted byte string. */
-    static void         AppendCString( SvStream& rStrm, ByteString& rString );
+    /** Appends a zero terminted byte string.
+        @param nLen
+               The previous length of the string, usually rString.Len(), but
+               necessary as this may be called from within AppendCString()
+               where rString is a temporary ByteString to be appended to
+               UniString. */
+    static void         AppendCStringWithLen( SvStream& rStrm, ByteString& rString, sal_uInt32 nLen );
     /** Appends a zero terminted byte string. */
     static void         AppendCString( SvStream& rStrm, String& rString, rtl_TextEncoding eTextEnc );
 

sc/source/filter/qpro/qpro.cxx

@@ -61,10 +61,16 @@ FltError ScQProReader::readSheet( SCTAB nTab, ScDocument* pDoc, ScQProStyle *pSt
             case 0x000f:{ // Label cell
                 String aLabel;
                 *mpStream >> nCol >> nDummy >> nRow >> nStyle >> nDummy;
-                readString( aLabel, getLength() - 7 );
-                nStyle = nStyle >> 3;
-                pStyle->SetFormat( pDoc, nCol, nRow, nTab, nStyle );
-                pDoc->PutCell( nCol, nRow, nTab, ScBaseCell::CreateTextCell( aLabel, pDoc ), (sal_Bool) sal_True );
+                sal_uInt16 nLen = getLength();
+                if (nLen >= 7)
+                {
+                    readString( aLabel, nLen - 7 );
+                    nStyle = nStyle >> 3;
+                    pStyle->SetFormat( pDoc, nCol, nRow, nTab, nStyle );
+                    pDoc->PutCell( nCol, nRow, nTab, ScBaseCell::CreateTextCell( aLabel, pDoc ), (sal_Bool) sal_True );
+                }
+                else
+                    eRet = eERR_FORMAT;
                 }
                 break;
 
@@ -192,7 +198,11 @@ FltError ScQProReader::import( ScDocument *pDoc )
                 String aLabel;
                 *mpStream >> nPtSize >> nFontAttr;
                 pStyleElement->setFontRecord( j, nFontAttr, nPtSize );
-                readString( aLabel, getLength() - 4 );
+                sal_uInt16 nLen = getLength();
+                if (nLen >= 4)
+                    readString( aLabel, nLen - 4 );
+                else
+                    eRet = eERR_FORMAT;
                 pStyleElement->setFontType( j, aLabel );
                 j++;
                 }