You have my sign off and pushed to 3-4.<br><br><div class="gmail_quote">2011/5/24 Kohei Yoshida <span dir="ltr"><<a href="mailto:kohei.yoshida@gmail.com">kohei.yoshida@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
The attached patch fixes the crasher reported in<br>
<br>
<a href="https://bugs.freedesktop.org/show_bug.cgi?id=37520" target="_blank">https://bugs.freedesktop.org/show_bug.cgi?id=37520</a><br>
<br>
The crash occurs in ScRangeList::Join() where the array size is cached<br>
prior to the for loop, but array may shrink during the loop, in which<br>
case an out-of-bound array access may occur which in turn results in a<br>
crash. I'm actually surprised that this didn't cause a crash on<br>
Linux.<br>
<br>
Anyhow, the solution is to always dynamically check the size of the<br>
array via size() method in each iteration, instead of caching it for<br>
all iterations.<br>
<br>
Review appreciated. I'd like this to go into the -3-4-0 branch. So I<br>
need three sign-off's.<br>
<font color="#888888"><br>
Kohei<br>
</font><br>_______________________________________________<br>
LibreOffice mailing list<br>
<a href="mailto:LibreOffice@lists.freedesktop.org">LibreOffice@lists.freedesktop.org</a><br>
<a href="http://lists.freedesktop.org/mailman/listinfo/libreoffice" target="_blank">http://lists.freedesktop.org/mailman/listinfo/libreoffice</a><br>
<br></blockquote></div><br>