[gnumeric] xls: fix fuzzed file crash.



commit a2fa11b07356bc8c583c143799dea850115fefe6
Author: Morten Welinder <terra gnome org>
Date:   Fri Sep 13 10:07:51 2013 -0400

    xls: fix fuzzed file crash.

 NEWS                          |    3 +++
 plugins/excel/ChangeLog       |    5 +++++
 plugins/excel/ms-excel-read.c |    6 +-----
 3 files changed, 9 insertions(+), 5 deletions(-)
---
diff --git a/NEWS b/NEWS
index 643071c..91f76be 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,9 @@ Gnumeric 1.12.8
 Jean:
        * Fix radio buttons behavior in covariance dialog. [#707595]
 
+Morten:
+       * Fix fuzzed file crash.  [#707875]
+
 --------------------------------------------------------------------------
 Gnumeric 1.12.7
 
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index b57decc..0036544 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,8 @@
+2013-09-13  Morten Welinder  <terra gnome org>
+
+       * ms-excel-read.c (ms_wb_parse_expr): Clear the whole thing,
+       notably the v7 part.  Fixes #707875.
+
 2013-09-01  Morten Welinder <terra gnome org>
 
        * Release 1.12.7
diff --git a/plugins/excel/ms-excel-read.c b/plugins/excel/ms-excel-read.c
index f987d0d..2861690 100644
--- a/plugins/excel/ms-excel-read.c
+++ b/plugins/excel/ms-excel-read.c
@@ -3214,12 +3214,8 @@ static GnmExprTop const *
 ms_wb_parse_expr (MSContainer *container, guint8 const *data, int length)
 {
        ExcelReadSheet dummy_sheet;
-
-       dummy_sheet.container.vtbl = NULL;
+       memset (&dummy_sheet, 0, sizeof (dummy_sheet));
        dummy_sheet.container.importer = (GnmXLImporter *)container;
-       dummy_sheet.sheet = NULL;
-       dummy_sheet.shared_formulae = NULL;
-       dummy_sheet.tables = NULL;
        return ms_sheet_parse_expr_internal (&dummy_sheet, data, length);
 }
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]