[Libreoffice-bugs] [Bug 132431] Crash: "vector::_M_fill_insert" with large sumifs

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=132431

Julien Nabet <serval2412 at yahoo.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |erack at redhat.com,
                   |                            |serval2412 at yahoo.fr

--- Comment #4 from Julien Nabet <serval2412 at yahoo.fr> ---
Eike: 
Following my last comment, I don't know if we must dig about why nEndColDiff is
negative and so nCol2 then nDimensionCols is negative or if this
straightforward patch would be sufficient:
diff --git a/sc/source/core/tool/interpr1.cxx
b/sc/source/core/tool/interpr1.cxx
index 03a8f46731a6..58d4fc2de725 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -6045,6 +6045,11 @@ void ScInterpreter::IterateParametersIfs(
double(*ResultFunc)( const sc::ParamIf
                 PushError ( FormulaError::IllegalArgument);
                 return;
             }
+            if ( (nDimensionCols <= 0) || (nDimensionRows <= 0) )
+            {
+                PushError ( FormulaError::IllegalArgument);
+                return;
+            }

             // recalculate matrix values
             if (nGlobalError != FormulaError::NONE)

(It avoids crash and displays Err:502 for the cell)
Any thoughts?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20200427/ddbd0cd1/attachment.htm>