CVE-2017-1210{8,9} were adressed in 1.0.0-2 upload
Note for reviewes, double check, but the patched code is at @@ -995,12 +1127,20 @@ void xls_preparseWorkSheet(xlsWorkSheet* /* If the ROW record is incorrect or missing, infer the information from * cell data. */ case XLS_RECORD_MULRK: + if (tmp.size < sizeof(MULRK)) { + retval = LIBXLS_ERROR_PARSE; + goto cleanup; + } if (pWS->rows.lastcol<xlsShortVal(((MULRK*)buf)->col) + (tmp.size - 6)/6 - 1) pWS->rows.lastcol=xlsShortVal(((MULRK*)buf)->col) + (tmp.size - 6)/6 - 1; if (pWS->rows.lastrow<xlsShortVal(((MULRK*)buf)->row)) pWS->rows.lastrow=xlsShortVal(((MULRK*)buf)->row); break; case XLS_RECORD_MULBLANK: + if (tmp.size < sizeof(MULBLANK)) { + retval = LIBXLS_ERROR_PARSE; + goto cleanup; + } if (pWS->rows.lastcol<xlsShortVal(((MULBLANK*)buf)->col) + (tmp.size - 6)/2 - 1) pWS->rows.lastcol=xlsShortVal(((MULBLANK*)buf)->col) + (tmp.size - 6)/2 - 1; if (pWS->rows.lastrow<xlsShortVal(((MULBLANK*)buf)->row))
Loading
Please register or sign in to comment