[Libreoffice-commits] core.git: sc/source

[Eike Rathke]

 sc/source/ui/docshell/externalrefmgr.cxx |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit a45fde7235f95792bf8e6f6979d0040637c5785d
Author: Eike Rathke <erack at redhat.com>
Date:   Mon Mar 17 13:50:20 2014 +0100

    justify range to prevent negative tab span and memory alloc, rhbz#1057741
    
    I could not reproduce the crash of that bug (probably having more memory
    available), but the backtrace had nTabSpan = -2 implicitly casted to
    size_t leading to allocation of a huge amount of memory with
    vector::reserve(), which ScRange::Justify() exactly prevents.
    
    Change-Id: Idb79e1be62649922ba793cab01e00011479fade9

diff --git a/sc/source/ui/docshell/externalrefmgr.cxx b/sc/source/ui/docshell/externalrefmgr.cxx
index 5b63848..76b3949 100644
--- a/sc/source/ui/docshell/externalrefmgr.cxx
+++ b/sc/source/ui/docshell/externalrefmgr.cxx
@@ -2078,6 +2078,7 @@ ScExternalRefCache::TokenArrayRef ScExternalRefManager::getDoubleRefTokensFromSr
     }
 
     ScRange aRange(rRange);
+    aRange.Justify();
     SCTAB nTabSpan = aRange.aEnd.Tab() - aRange.aStart.Tab();
 
     vector<ScExternalRefCache::SingleRangeData> aCacheData;