Hi, I have submitted a patch for review:
https://gerrit.libreoffice.org/3340 To pull it, you can do: git pull ssh://gerrit.libreoffice.org:29418/core refs/changes/40/3340/1 prevent vector and sequence out of bounds access, fdo#60300 This fixes the symptom of the crash but not the underlying cause why a subtotal count would be wrong. (cherry picked from commit 8bd3be9915ff28458d010fc8f0a1a1ab66d730b0) Conflicts: sc/source/core/data/dpoutput.cxx Change-Id: I3782b5e39f18bc65ffe510b847ffa7969a26cd37 --- M sc/source/core/data/dpoutput.cxx 1 file changed, 42 insertions(+), 12 deletions(-) diff --git a/sc/source/core/data/dpoutput.cxx b/sc/source/core/data/dpoutput.cxx index d78f83e..380e1f3 100644 --- a/sc/source/core/data/dpoutput.cxx +++ b/sc/source/core/data/dpoutput.cxx @@ -1707,11 +1707,19 @@ { // grand total is always automatic sal_Int32 nDataPos = j - ( nSize - nGrandTotals ); - OSL_ENSURE( nDataPos < (sal_Int32)rDataNames.size(), "wrong data count" ); - rtl::OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names - rtl::OUString aGivenName( rGivenNames[nDataPos] ); + if (nDataPos >= 0 && nDataPos < (sal_Int32)rDataNames.size() && + nDataPos < (sal_Int32)rGivenNames.size()) + { + OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names + OUString aGivenName( rGivenNames[nDataPos] ); - rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ); + rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ); + } + else + { + OSL_FAIL( "wrong data count for grand total" ); + rResult[j] = false; + } } } @@ -1747,27 +1755,49 @@ rtl::OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names rtl::OUString aGivenName( rGivenNames[nDataPos] ); - OSL_ENSURE( nFuncPos < aSubTotals.getLength(), "wrong subtotal count" ); - rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ) && + if (nFuncPos < aSubTotals.getLength()) + { + rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ) && aSubTotals[nFuncPos] == aFilter.meFunction; + } + else + { + OSL_FAIL( "wrong subtotal count for manual subtotals and several data fields" ); + rResult[j] = false; + } } else { // manual subtotals for a single data field - OSL_ENSURE( nSubTotalCount < aSubTotals.getLength(), "wrong subtotal count" ); - rResult[j] = ( aSubTotals[nSubTotalCount] == aFilter.meFunction ); + if (nSubTotalCount < aSubTotals.getLength()) + { + rResult[j] = ( aSubTotals[nSubTotalCount] == aFilter.meFunction ); + } + else + { + OSL_FAIL( "wrong subtotal count for manual subtotals for a single data field" ); + rResult[j] = false; + } } } else // automatic subtotals { if ( rBeforeDataLayout ) { - OSL_ENSURE( nSubTotalCount < (sal_Int32)rDataNames.size(), "wrong data count" ); - rtl::OUString aSourceName( rDataNames[nSubTotalCount] ); // vector contains source names - rtl::OUString aGivenName( rGivenNames[nSubTotalCount] ); + if (nSubTotalCount < (sal_Int32)rDataNames.size() && + nSubTotalCount < (sal_Int32)rGivenNames.size()) + { + OUString aSourceName( rDataNames[nSubTotalCount] ); // vector contains source names + OUString aGivenName( rGivenNames[nSubTotalCount] ); - rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ); + rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ); + } + else + { + OSL_FAIL( "wrong data count for automatic subtotals" ); + rResult[j] = false; + } } // if a function was specified, automatic subtotals never match -- To view, visit https://gerrit.libreoffice.org/3340 To unsubscribe, visit https://gerrit.libreoffice.org/settings Gerrit-MessageType: newchange Gerrit-Change-Id: I3782b5e39f18bc65ffe510b847ffa7969a26cd37 Gerrit-PatchSet: 1 Gerrit-Project: core Gerrit-Branch: libreoffice-4-0 Gerrit-Owner: Eike Rathke <er...@redhat.com> _______________________________________________ LibreOffice mailing list LibreOffice@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice