rpms/libreoffice
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Debrand for AlmaLinux

Browse Source
This commit is contained in:
Eduard Abdullin 2026-07-15 12:33:25 +00:00 committed by root
commit d5584785a8
2 changed files with 46 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
SOURCES/0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch Normal file
View File

@ -0,0 +1,37 @@
From a28cead4b7796642d946173b479281a6272117f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Sun, 26 Apr 2026 17:12:34 +0100
Subject: [PATCH] A formula of length L, composed entirely of open tokens,
needs L+1 slots
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I7cf1fd4fdaca780a8f0cf0d0b9d10def9b3af1ef
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1690
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 0b7a9149d7c7b5e044bb4f02668297bdf41b64d6)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/205090
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
---
sc/source/core/tool/compiler.cxx | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx
index d1a6c8937ec61..f5b87efba2836 100644
--- a/sc/source/core/tool/compiler.cxx
+++ b/sc/source/core/tool/compiler.cxx
@@ -5058,8 +5058,9 @@ std::unique_ptr<ScTokenArray> ScCompiler::CompileString( const OUString& rFormul
bool bUseFunctionStack = (bPODF || bOOXML);
const size_t nAlloc = 512;
FunctionStack aFuncs[ nAlloc ];
- FunctionStack* pFunctionStack = (bUseFunctionStack && o3tl::make_unsigned(rFormula.getLength()) > nAlloc ?
- new FunctionStack[rFormula.getLength()] : &aFuncs[0]);
+ // A formula of length L composed entirely of open tokens needs L+1 slots,
+ FunctionStack* pFunctionStack = (bUseFunctionStack && o3tl::make_unsigned(rFormula.getLength()) >= nAlloc ?
+ new FunctionStack[rFormula.getLength() + 1] : &aFuncs[0]);
pFunctionStack[0].eOp = ocNone;
pFunctionStack[0].nSep = 0;
size_t nFunction = 0;

11
SPECS/libreoffice.spec
View File

@ -62,7 +62,7 @@ Summary: Free Software Productivity Suite
Name: libreoffice
Epoch: 1
Version: %{libo_version}.1
Release: 15%{?libo_prerelease}%{?dist}.1.alma.1
Release: 15%{?libo_prerelease}%{?dist}.2.alma.1
License: (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0
URL: http://www.libreoffice.org/
@ -306,6 +306,8 @@ Patch45: 0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur
Patch46: 0001-CVE-2025-1080-Filter-out-more-unwanted-command-URIs.patch
# https://gerrit.libreoffice.org/c/core/+/202756
Patch47: 0001-CVE-2026-4430-Conform-AlignEngine-parsing.patch
# https://github.com/LibreOffice/core/commit/a28cead4b7796642d946173b479281a6272117f2
Patch48: 0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch
# not upstreamed
Patch500: 0001-disable-libe-book-support.patch
@ -2299,9 +2301,14 @@ gtk-update-icon-cache -q %{_datadir}/icons/hicolor &>/dev/null || :
%{_includedir}/LibreOfficeKit
%changelog
* Mon Jul 06 2026 Eduard Abdullin <eabdullin@almalinux.org> - 1:7.1.8.1-15.1.alma.1
* Wed Jul 15 2026 Eduard Abdullin <eabdullin@almalinux.org> - 1:7.1.8.1-15.2.alma.1
- Debrand for AlmaLinux
* Mon Jun 29 2026 Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.2
- Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in
formula compilation
- Resolves: RHEL-186062
* Tue May 19 2026 Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.1
- Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
the spec has