memory: fix invalid string array indexes

See #482

Author: jmcnamara

src/workbook.c

@@ -737,8 +737,10 @@ _store_defined_name(lxw_workbook *self, const char *name,
         /* Remove any worksheet quoting. */
         if (worksheet_name[0] == '\'')
             worksheet_name++;
-        if (worksheet_name[strlen(worksheet_name) - 1] == '\'')
+        if (strlen(worksheet_name) > 0
+            && worksheet_name[strlen(worksheet_name) - 1] == '\'') {
             worksheet_name[strlen(worksheet_name) - 1] = '\0';
+        }
 
         /* Search for worksheet name to get the equivalent worksheet index. */
         STAILQ_FOREACH(sheet, self->sheets, list_pointers) {
@@ -976,8 +978,9 @@ _populate_range_dimensions(lxw_workbook *self, lxw_series_range *range)
         /* Remove any worksheet quoting. */
         if (sheetname[0] == '\'')
             sheetname++;
-        if (sheetname[strlen(sheetname) - 1] == '\'')
+        if (strlen(sheetname) > 0 && sheetname[strlen(sheetname) - 1] == '\'') {
             sheetname[strlen(sheetname) - 1] = '\0';
+        }
 
         /* Check that the sheetname exists. */
         if (!workbook_get_worksheet_by_name(self, sheetname)) {

src/worksheet.c

@@ -8127,16 +8127,25 @@ _store_array_formula(lxw_worksheet *self,
 
     /* Copy and trip leading "{=" from formula. */
     if (formula[0] == '{')
-        if (formula[1] == '=')
+        if (strlen(formula) >= 2 && formula[1] == '=')
             formula_copy = lxw_strdup(formula + 2);
         else
             formula_copy = lxw_strdup(formula + 1);
     else
         formula_copy = lxw_strdup_formula(formula);
 
     /* Strip trailing "}" from formula. */
-    if (formula_copy[strlen(formula_copy) - 1] == '}')
+    if (strlen(formula_copy) > 0
+        && formula_copy[strlen(formula_copy) - 1] == '}') {
         formula_copy[strlen(formula_copy) - 1] = '\0';
+    }
+
+    /* Check for empty formula that started as {=}. */
+    if (lxw_str_is_empty(formula_copy)) {
+        free(formula_copy);
+        free(range);
+        return LXW_ERROR_PARAMETER_IS_EMPTY;
+    }
 
     /* Create a new array formula cell object. */
     cell = _new_array_formula_cell(first_row, first_col,

test/unit/worksheet/test_worksheet_range_returns.c

@@ -105,6 +105,19 @@ CTEST(worksheet, bound_checks01) {
     err = worksheet_set_column(worksheet, MAX_COL, 6, 17, NULL);
     ASSERT_EQUAL(LXW_ERROR_WORKSHEET_INDEX_OUT_OF_RANGE, err);
 
+    /* Tests array formula strings. */
+    err = worksheet_write_array_formula(worksheet, 0, 0, 0, 0, "{", NULL);
+    ASSERT_EQUAL(LXW_ERROR_PARAMETER_IS_EMPTY, err);
+
+    err = worksheet_write_array_formula(worksheet, 0, 0, 0, 0, "}", NULL);
+    ASSERT_EQUAL(LXW_ERROR_PARAMETER_IS_EMPTY, err);
+
+    err = worksheet_write_array_formula(worksheet, 0, 0, 0, 0, "{}", NULL);
+    ASSERT_EQUAL(LXW_ERROR_PARAMETER_IS_EMPTY, err);
+
+    err = worksheet_write_array_formula(worksheet, 0, 0, 0, 0, "{=}", NULL);
+    ASSERT_EQUAL(LXW_ERROR_PARAMETER_IS_EMPTY, err);
+
     lxw_worksheet_assemble_xml_file(worksheet);
 
     lxw_worksheet_free(worksheet);