<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 24/05/2011 22:03, Kohei Yoshida wrote:
<blockquote
cite="mid:BANLkTi=fUy-VFCCgb1Qsym-YO9sNO0WcgA@mail.gmail.com"
type="cite">
<pre wrap="">The attached patch fixes the crasher reported in
<a class="moz-txt-link-freetext" href="https://bugs.freedesktop.org/show_bug.cgi?id=37520">https://bugs.freedesktop.org/show_bug.cgi?id=37520</a>
The crash occurs in ScRangeList::Join() where the array size is cached
prior to the for loop, but array may shrink during the loop, in which
case an out-of-bound array access may occur which in turn results in a
crash. I'm actually surprised that this didn't cause a crash on
Linux.
</pre>
</blockquote>
Kohei in this case wouldnt it be better to use a linked list instead
of an array since a link list can easily adjust to size instead of
an array which is of a static size?<br>
<br>
<blockquote
cite="mid:BANLkTi=fUy-VFCCgb1Qsym-YO9sNO0WcgA@mail.gmail.com"
type="cite">
<pre wrap="">Anyhow, the solution is to always dynamically check the size of the
array via size() method in each iteration, instead of caching it for
all iterations.
Review appreciated. I'd like this to go into the -3-4-0 branch. So I
need three sign-off's.
Kohei
</pre>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
LibreOffice mailing list
<a class="moz-txt-link-abbreviated" href="mailto:LibreOffice@lists.freedesktop.org">LibreOffice@lists.freedesktop.org</a>
<a class="moz-txt-link-freetext" href="http://lists.freedesktop.org/mailman/listinfo/libreoffice">http://lists.freedesktop.org/mailman/listinfo/libreoffice</a>
</pre>
</blockquote>
<br>
</body>
</html>