[Libreoffice-commits] .: sc/source
Kohei Yoshida
kohei at kemper.freedesktop.org
Tue Jun 7 11:57:12 PDT 2011
sc/source/ui/inc/viewdata.hxx | 1 +
sc/source/ui/view/viewdata.cxx | 14 +++++++++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
New commits:
commit df7048dc10cc8a428cdf7b5426802179f2f1a28a
Author: Kohei Yoshida <kyoshida at novell.com>
Date: Tue Jun 7 14:54:43 2011 -0400
Fixed out-of-bound access to array, which would cause a crash later.
And the crash was caused in a not-so-obvious way that it was near
impossible to link it to the cause. I had to resort to full inspection
of how the array was accessed in various methods.
diff --git a/sc/source/ui/inc/viewdata.hxx b/sc/source/ui/inc/viewdata.hxx
index f63ccfd..fb86f15 100644
--- a/sc/source/ui/inc/viewdata.hxx
+++ b/sc/source/ui/inc/viewdata.hxx
@@ -236,6 +236,7 @@ private:
SC_DLLPRIVATE void CreateTabData( SCTAB nNewTab );
SC_DLLPRIVATE void CreateTabData( std::vector< SCTAB >& rvTabs );
SC_DLLPRIVATE void CreateSelectedTabData();
+ SC_DLLPRIVATE void EnsureTabDataSize(size_t nSize);
public:
ScViewData( ScDocShell* pDocSh, ScTabViewShell* pViewSh );
diff --git a/sc/source/ui/view/viewdata.cxx b/sc/source/ui/view/viewdata.cxx
index 07bc34e..ff1ce87 100644
--- a/sc/source/ui/view/viewdata.cxx
+++ b/sc/source/ui/view/viewdata.cxx
@@ -1450,6 +1450,15 @@ void ScViewData::CreateSelectedTabData()
CreateTabData( i );
}
+void ScViewData::EnsureTabDataSize(size_t nSize)
+{
+ if (nSize >= maTabData.size())
+ {
+ size_t n = nSize - maTabData.size() + 1;
+ maTabData.insert(maTabData.end(), n, NULL);
+ }
+}
+
void ScViewData::SetTabNo( SCTAB nNewTab )
{
if (!ValidTab(nNewTab))
@@ -2758,7 +2767,10 @@ void ScViewData::ReadUserDataSequence(const uno::Sequence <beans::PropertyValue>
uno::Sequence<beans::PropertyValue> aTabSettings;
if (aAny >>= aTabSettings)
{
- maTabData[nTab] = new ScViewDataTable;
+ EnsureTabDataSize(nTab + 1);
+ if (!maTabData[nTab])
+ maTabData[nTab] = new ScViewDataTable;
+
bool bHasZoom = false;
maTabData[nTab]->ReadUserDataSequence(aTabSettings, *this, nTab, bHasZoom);
aHasZoomVect[nTab] = bHasZoom;
More information about the Libreoffice-commits
mailing list