Commit 04f168db authored by Morten Welinder's avatar Morten Welinder

xml: avoid near-infitely loop for bogus column/row info.

parent b84353f2
......@@ -2,6 +2,7 @@
* src/xml-sax-read.c (xml_sax_must_have_sheet): New function. Use
heavily throughout the parser. Fixes #626043.
(xml_sax_colrow): Avoid near-infinite loop.
2010-08-04 Morten Welinder <terra@gnome.org>
......
......@@ -1273,8 +1273,7 @@ xml_sax_colrow (GsfXMLIn *xin, xmlChar const **attrs)
int hidden = 0, hard_size = 0, is_collapsed = 0, outline_level = 0;
int count = 1;
gboolean const is_col = xin->node->user_data.v_bool;
xml_sax_must_have_sheet (state);
Sheet *sheet = xml_sax_must_have_sheet (state);
maybe_update_progress (xin);
......@@ -1301,6 +1300,10 @@ xml_sax_colrow (GsfXMLIn *xin, xmlChar const **attrs)
}
}
XML_CHECK (pos >= 0 && pos < colrow_max (is_col, sheet));
XML_CHECK (count >= 1);
XML_CHECK (count <= colrow_max (is_col, sheet) - pos);
g_return_if_fail (cri != NULL && size > -1.);
cri->hard_size = hard_size;
cri->visible = !hidden;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment