Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-25 Thread Noel Power
On 24/05/11 21:03, Kohei Yoshida wrote: The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but array may shrink during the loop, in which case an

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-25 Thread Kohei Yoshida
On Wed, 2011-05-25 at 10:14 +0100, Noel Power wrote: the third and pushed to 3.4.0 ( not sure are we finished with that branch though ) Looks like this fix missed the boat for 3.4.0. Thanks for your review anyway. Kohei -- Kohei Yoshida, LibreOffice hacker, Calc kyosh...@novell.com

[Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Kohei Yoshida
The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but array may shrink during the loop, in which case an out-of-bound array access may occur which in

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Markus Mohrhard
You have my sign off and pushed to 3-4. 2011/5/24 Kohei Yoshida kohei.yosh...@gmail.com The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Jonathan Aquilina
On 24/05/2011 22:03, Kohei Yoshida wrote: The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but array may shrink during the loop, in which case an

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Norbert Thiebaud
On Tue, May 24, 2011 at 3:03 PM, Kohei Yoshida kohei.yosh...@gmail.com wrote: The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but array may shrink