Hi,
I have submitted a patch for review:
https://gerrit.libreoffice.org/3344
To pull it, you can do:
git pull ssh://gerrit.libreoffice.org:29418/core refs/changes/44/3344/1
prevent vector and sequence out of bounds access, fdo#60300
This fixes the symptom of the crash but not the underlying cause why a
subtotal count would be wrong.
(cherry picked from commit 8bd3be9915ff28458d010fc8f0a1a1ab66d730b0)
Conflicts:
sc/source/core/data/dpoutput.cxx
Change-Id: I3782b5e39f18bc65ffe510b847ffa7969a26cd37
---
M sc/source/core/data/dpoutput.cxx
1 file changed, 42 insertions(+), 12 deletions(-)
diff --git a/sc/source/core/data/dpoutput.cxx b/sc/source/core/data/dpoutput.cxx
index 2b86a69..2c60dd6 100644
--- a/sc/source/core/data/dpoutput.cxx
+++ b/sc/source/core/data/dpoutput.cxx
@@ -1667,11 +1667,19 @@
{
// grand total is always automatic
sal_Int32 nDataPos = j - ( nSize - nGrandTotals );
- OSL_ENSURE( nDataPos < (sal_Int32)rDataNames.size(),
"wrong data count" );
- rtl::OUString aSourceName( rDataNames[nDataPos] ); //
vector contains source names
- rtl::OUString aGivenName( rGivenNames[nDataPos] );
+ if (nDataPos >= 0 && nDataPos <
(sal_Int32)rDataNames.size() &&
+ nDataPos < (sal_Int32)rGivenNames.size())
+ {
+ rtl::OUString aSourceName( rDataNames[nDataPos] );
// vector contains source names
+ rtl::OUString aGivenName( rGivenNames[nDataPos] );
- rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName,
aGivenName );
+ rResult[j] = lcl_IsNamedDataField( rTarget,
aSourceName, aGivenName );
+ }
+ else
+ {
+ OSL_FAIL( "wrong data count for grand total" );
+ rResult[j] = false;
+ }
}
}
@@ -1707,27 +1715,49 @@
rtl::OUString aSourceName( rDataNames[nDataPos] );
// vector contains source names
rtl::OUString aGivenName( rGivenNames[nDataPos] );
- OSL_ENSURE( nFuncPos < aSubTotals.getLength(), "wrong
subtotal count" );
- rResult[j] = lcl_IsNamedDataField( rTarget,
aSourceName, aGivenName ) &&
+ if (nFuncPos < aSubTotals.getLength())
+ {
+ rResult[j] = lcl_IsNamedDataField( rTarget,
aSourceName, aGivenName ) &&
aSubTotals[nFuncPos] ==
aFilter.meFunction;
+ }
+ else
+ {
+ OSL_FAIL( "wrong subtotal count for manual
subtotals and several data fields" );
+ rResult[j] = false;
+ }
}
else
{
// manual subtotals for a single data field
- OSL_ENSURE( nSubTotalCount < aSubTotals.getLength(),
"wrong subtotal count" );
- rResult[j] = ( aSubTotals[nSubTotalCount] ==
aFilter.meFunction );
+ if (nSubTotalCount < aSubTotals.getLength())
+ {
+ rResult[j] = ( aSubTotals[nSubTotalCount] ==
aFilter.meFunction );
+ }
+ else
+ {
+ OSL_FAIL( "wrong subtotal count for manual
subtotals for a single data field" );
+ rResult[j] = false;
+ }
}
}
else // automatic subtotals
{
if ( rBeforeDataLayout )
{
- OSL_ENSURE( nSubTotalCount <
(sal_Int32)rDataNames.size(), "wrong data count" );
- rtl::OUString aSourceName( rDataNames[nSubTotalCount]
); // vector contains source names
- rtl::OUString aGivenName( rGivenNames[nSubTotalCount]
);
+ if (nSubTotalCount < (sal_Int32)rDataNames.size() &&
+ nSubTotalCount < (sal_Int32)rGivenNames.size())
+ {
+ rtl::OUString aSourceName(
rDataNames[nSubTotalCount] ); // vector contains source names
+ rtl::OUString aGivenName(
rGivenNames[nSubTotalCount] );
- rResult[j] = lcl_IsNamedDataField( rTarget,
aSourceName, aGivenName );
+ rResult[j] = lcl_IsNamedDataField( rTarget,
aSourceName, aGivenName );
+ }
+ else
+ {
+ OSL_FAIL( "wrong data count for automatic
subtotals" );
+ rResult[j] = false;
+ }
}
// if a function was specified, automatic subtotals never
match
--
To view, visit https://gerrit.libreoffice.org/3344
To unsubscribe, visit https://gerrit.libreoffice.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I3782b5e39f18bc65ffe510b847ffa7969a26cd37
Gerrit-PatchSet: 1
Gerrit-Project: core
Gerrit-Branch: libreoffice-3-6
Gerrit-Owner: Eike Rathke <[email protected]>
_______________________________________________
LibreOffice mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/libreoffice
