Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-25 Thread Kohei Yoshida
On Wed, 2011-05-25 at 10:14 +0100, Noel Power wrote: > the third and pushed to 3.4.0 ( not sure are we finished with that > branch though ) Looks like this fix missed the boat for 3.4.0. Thanks for your review anyway. Kohei -- Kohei Yoshida, LibreOffice hacker, Calc ___

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-25 Thread Noel Power
On 24/05/11 21:03, Kohei Yoshida wrote: The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but array may shrink during the loop, in which case an out-of

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Norbert Thiebaud
On Tue, May 24, 2011 at 3:03 PM, Kohei Yoshida wrote: > The attached patch fixes the crasher reported in > > https://bugs.freedesktop.org/show_bug.cgi?id=37520 > > The crash occurs in ScRangeList::Join() where the array size is cached > prior to the for loop, but array may shrink during the loop,

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Jonathan Aquilina
On 24/05/2011 22:03, Kohei Yoshida wrote: The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but array may shrink during the loop, in which case an out-

Re: [Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Markus Mohrhard
You have my sign off and pushed to 3-4. 2011/5/24 Kohei Yoshida > The attached patch fixes the crasher reported in > > https://bugs.freedesktop.org/show_bug.cgi?id=37520 > > The crash occurs in ScRangeList::Join() where the array size is cached > prior to the for loop, but array may shrink durin

[Libreoffice] [REVIEW] Fix for fdo#37520

2011-05-24 Thread Kohei Yoshida
The attached patch fixes the crasher reported in https://bugs.freedesktop.org/show_bug.cgi?id=37520 The crash occurs in ScRangeList::Join() where the array size is cached prior to the for loop, but array may shrink during the loop, in which case an out-of-bound array access may occur which in tur