[Libreoffice-commits] core.git: Branch 'libreoffice-4-2' - sc/source

[Eike Rathke]

 sc/source/ui/docshell/externalrefmgr.cxx |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit dde6049fe4abc03b8f98ffca1a940d6f2f446095
Author: Eike Rathke <erack at redhat.com>
Date:   Mon Mar 17 13:50:20 2014 +0100

    justify range to prevent negative tab span and memory alloc, rhbz#1057741
    
    I could not reproduce the crash of that bug (probably having more memory
    available), but the backtrace had nTabSpan = -2 implicitly casted to
    size_t leading to allocation of a huge amount of memory with
    vector::reserve(), which ScRange::Justify() exactly prevents.
    
    Change-Id: Idb79e1be62649922ba793cab01e00011479fade9
    (cherry picked from commit a45fde7235f95792bf8e6f6979d0040637c5785d)
    Reviewed-on: https://gerrit.libreoffice.org/8624
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/ui/docshell/externalrefmgr.cxx b/sc/source/ui/docshell/externalrefmgr.cxx
index b2a19d9..3c051ac 100644
--- a/sc/source/ui/docshell/externalrefmgr.cxx
+++ b/sc/source/ui/docshell/externalrefmgr.cxx
@@ -2078,6 +2078,7 @@ ScExternalRefCache::TokenArrayRef ScExternalRefManager::getDoubleRefTokensFromSr
     }
 
     ScRange aRange(rRange);
+    aRange.Justify();
     SCTAB nTabSpan = aRange.aEnd.Tab() - aRange.aStart.Tab();
 
     vector<ScExternalRefCache::SingleRangeData> aCacheData;