freexl -- integer overflow
Stefan Cornelius reports:
There's an integer overflow in the allocate_cells() function
when trying to allocate the memory for worksheet with specially
crafted row/column dimensions. This can be exploited to cause a
heap memory corruption. The most likely outcome of this is a crash
when trying to initialize the cells later in the function.
Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright