mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

prevent vector and sequence out of bounds access, fdo#60300

Browse Source 
This fixes the symptom of the crash but not the underlying cause why a
subtotal count would be wrong.

Change-Id: I3782b5e39f18bc65ffe510b847ffa7969a26cd37
This commit is contained in:
Eike Rathke
2013-04-11 16:50:15 +02:00
parent a33e45182c
commit 8bd3be9915
1 changed files with 42 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
sc/source/core/data/dpoutput.cxx
View File

@@ -1697,11 +1697,19 @@ void lcl_FilterInclude( std::vector<bool>& rResult, std::vector< sal_Int32 >& rS
{ {
// grand total is always automatic // grand total is always automatic
sal_Int32 nDataPos = j - ( nSize - nGrandTotals ); sal_Int32 nDataPos = j - ( nSize - nGrandTotals );
OSL_ENSURE( nDataPos < (sal_Int32)rDataNames.size(), "wrong data count" ); if (nDataPos >= 0 && nDataPos < (sal_Int32)rDataNames.size() &&
OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names nDataPos < (sal_Int32)rGivenNames.size())
OUString aGivenName( rGivenNames[nDataPos] ); {
OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names
OUString aGivenName( rGivenNames[nDataPos] );
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ); rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName );
}
else
{
OSL_FAIL( "wrong data count for grand total" );
rResult[j] = false;
}
} }
} }
@@ -1737,27 +1745,49 @@ void lcl_FilterInclude( std::vector<bool>& rResult, std::vector< sal_Int32 >& rS
OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names OUString aSourceName( rDataNames[nDataPos] ); // vector contains source names
OUString aGivenName( rGivenNames[nDataPos] ); OUString aGivenName( rGivenNames[nDataPos] );
OSL_ENSURE( nFuncPos < aSubTotals.getLength(), "wrong subtotal count" ); if (nFuncPos < aSubTotals.getLength())
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ) && {
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ) &&
aSubTotals[nFuncPos] == aFilter.meFunction; aSubTotals[nFuncPos] == aFilter.meFunction;
}
else
{
OSL_FAIL( "wrong subtotal count for manual subtotals and several data fields" );
rResult[j] = false;
}
} }
else else
{ {
// manual subtotals for a single data field // manual subtotals for a single data field
OSL_ENSURE( nSubTotalCount < aSubTotals.getLength(), "wrong subtotal count" ); if (nSubTotalCount < aSubTotals.getLength())
rResult[j] = ( aSubTotals[nSubTotalCount] == aFilter.meFunction ); {
rResult[j] = ( aSubTotals[nSubTotalCount] == aFilter.meFunction );
}
else
{
OSL_FAIL( "wrong subtotal count for manual subtotals for a single data field" );
rResult[j] = false;
}
} }
} }
else // automatic subtotals else // automatic subtotals
{ {
if ( rBeforeDataLayout ) if ( rBeforeDataLayout )
{ {
OSL_ENSURE( nSubTotalCount < (sal_Int32)rDataNames.size(), "wrong data count" ); if (nSubTotalCount < (sal_Int32)rDataNames.size() &&
OUString aSourceName( rDataNames[nSubTotalCount] ); // vector contains source names nSubTotalCount < (sal_Int32)rGivenNames.size())
OUString aGivenName( rGivenNames[nSubTotalCount] ); {
OUString aSourceName( rDataNames[nSubTotalCount] ); // vector contains source names
OUString aGivenName( rGivenNames[nSubTotalCount] );
rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName ); rResult[j] = lcl_IsNamedDataField( rTarget, aSourceName, aGivenName );
}
else
{
OSL_FAIL( "wrong data count for automatic subtotals" );
rResult[j] = false;
}
} }
// if a function was specified, automatic subtotals never match // if a function was specified, automatic subtotals never match