mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prevent vector and sequence out of bounds access, fdo#60300

Browse Source 
This fixes the symptom of the crash but not the underlying cause why a
subtotal count would be wrong.

Change-Id: I3782b5e39f18bc65ffe510b847ffa7969a26cd37
This commit is contained in:
Eike Rathke
2013-04-11 16:50:15 +02:00
parent a33e45182c
commit 8bd3be9915
1 changed files with 42 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
sc/source/core/data/dpoutput.cxx
View File

@@ -1697,11 +1697,19 @@ void lcl_FilterInclude( std::vector<bool>& rResult, std::vector< sal_Int32 >& rS
{
// grand total is always automatic
sal_Int32 nDataPos = j - ( nSize - nGrandTotals );
OSL_ENSURE( nDataPos < (sal_Int32)rDataNames.size(), "wrong data count" );
OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names
OUString aGivenName( rGivenNames[nDataPos] );
if (nDataPos >= 0 && nDataPos < (sal_Int32)rDataNames.size() &&
nDataPos < (sal_Int32)rGivenNames.size())
{
OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names
OUString aGivenName( rGivenNames[nDataPos] );
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName );
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName );
}
else
{
OSL_FAIL( "wrong data count for grand total" );
rResult[j] = false;
}
}
}
@@ -1737,27 +1745,49 @@ void lcl_FilterInclude( std::vector<bool>& rResult, std::vector< sal_Int32 >& rS
OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names
OUString aGivenName( rGivenNames[nDataPos] );
OSL_ENSURE( nFuncPos < aSubTotals.getLength(), "wrong subtotal count" );
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ) &&
if (nFuncPos < aSubTotals.getLength())
{
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ) &&
aSubTotals[nFuncPos] == aFilter.meFunction;
}
else
{
OSL_FAIL( "wrong subtotal count for manual subtotals and several data fields" );
rResult[j] = false;
}
}
else
{
// manual subtotals for a single data field
OSL_ENSURE( nSubTotalCount < aSubTotals.getLength(), "wrong subtotal count" );
rResult[j] = ( aSubTotals[nSubTotalCount] == aFilter.meFunction );
if (nSubTotalCount < aSubTotals.getLength())
{
rResult[j] = ( aSubTotals[nSubTotalCount] == aFilter.meFunction );
}
else
{
OSL_FAIL( "wrong subtotal count for manual subtotals for a single data field" );
rResult[j] = false;
}
}
}
else // automatic subtotals
{
if ( rBeforeDataLayout )
{
OSL_ENSURE( nSubTotalCount < (sal_Int32)rDataNames.size(), "wrong data count" );
OUString aSourceName( rDataNames[nSubTotalCount] ); // vector contains source names
OUString aGivenName( rGivenNames[nSubTotalCount] );
if (nSubTotalCount < (sal_Int32)rDataNames.size() &&
nSubTotalCount < (sal_Int32)rGivenNames.size())
{
OUString aSourceName( rDataNames[nSubTotalCount] ); // vector contains source names
OUString aGivenName( rGivenNames[nSubTotalCount] );
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName );
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName );
}
else
{
OSL_FAIL( "wrong data count for automatic subtotals" );
rResult[j] = false;
}
}
// if a function was specified, automatic subtotals never match