[Libreoffice-commits] .: Branch 'libreoffice-3-6' - sc/source

[Libreoffice Gerrit user]

 sc/source/core/data/dpcache.cxx  |    5 +++++
 sc/source/core/data/dpshttab.cxx |    8 ++++++++
 2 files changed, 13 insertions(+)

New commits:
commit 82b03180e66559c53911c404af455ca0d3505948
Author: Kohei Yoshida <kohei.yoshida at gmail.com>
Date:   Fri Dec 14 22:34:38 2012 -0500

    Do extra check on source range to make sure no funny things happen.
    
    Like a crash in the pivot layout dialog... :-/
    
    Change-Id: I9a330ee3f39ebacb7299d24868bb13ee2a9c3ec5
    Reviewed-on: https://gerrit.libreoffice.org/1345
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/core/data/dpcache.cxx b/sc/source/core/data/dpcache.cxx
index 6113282..7fdf098 100644
--- a/sc/source/core/data/dpcache.cxx
+++ b/sc/source/core/data/dpcache.cxx
@@ -382,6 +382,11 @@ bool ScDPCache::InitFromDoc(ScDocument* pDoc, const ScRange& rRange)
 
     SCROW nStartRow = rRange.aStart.Row();  // start of data
     SCROW nEndRow = rRange.aEnd.Row();
+
+    // Sanity check
+    if (!ValidRow(nStartRow) || !ValidRow(nEndRow) || nEndRow-nStartRow <= 0)
+        return false;
+
     sal_uInt16 nStartCol = rRange.aStart.Col();
     sal_uInt16 nEndCol = rRange.aEnd.Col();
     sal_uInt16 nDocTab = rRange.aStart.Tab();
diff --git a/sc/source/core/data/dpshttab.cxx b/sc/source/core/data/dpshttab.cxx
index 8ee3d4e..d2d8faf 100644
--- a/sc/source/core/data/dpshttab.cxx
+++ b/sc/source/core/data/dpshttab.cxx
@@ -335,6 +335,14 @@ sal_uLong ScSheetSourceDesc::CheckSourceRange() const
     if (!mpDoc)
         return STR_ERR_DATAPILOTSOURCE;
 
+    // Make sure the range is valid and sane.
+    const ScRange& rSrcRange = GetSourceRange();
+    if (!rSrcRange.IsValid())
+        return STR_ERR_DATAPILOTSOURCE;
+
+    if (rSrcRange.aStart.Col() > rSrcRange.aEnd.Col() || rSrcRange.aStart.Row() > rSrcRange.aEnd.Row())
+        return STR_ERR_DATAPILOTSOURCE;
+
     return 0;
 }