[Libreoffice-commits] core.git: Branch 'libreoffice-4-1' - sc/source

[Eike Rathke]

 sc/source/ui/docshell/externalrefmgr.cxx |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit cc605367d4f135adc815582900794f0cfdb88aa7
Author: Eike Rathke <erack at redhat.com>
Date:   Mon Mar 17 13:50:20 2014 +0100

    justify range to prevent negative tab span and memory alloc, rhbz#1057741
    
    I could not reproduce the crash of that bug (probably having more memory
    available), but the backtrace had nTabSpan = -2 implicitly casted to
    size_t leading to allocation of a huge amount of memory with
    vector::reserve(), which ScRange::Justify() exactly prevents.
    
    Change-Id: Idb79e1be62649922ba793cab01e00011479fade9
    (cherry picked from commit a45fde7235f95792bf8e6f6979d0040637c5785d)
    Reviewed-on: https://gerrit.libreoffice.org/8625
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/ui/docshell/externalrefmgr.cxx b/sc/source/ui/docshell/externalrefmgr.cxx
index 8b5b40d..3e142eb 100644
--- a/sc/source/ui/docshell/externalrefmgr.cxx
+++ b/sc/source/ui/docshell/externalrefmgr.cxx
@@ -1927,6 +1927,7 @@ ScExternalRefCache::TokenArrayRef ScExternalRefManager::getDoubleRefTokensFromSr
     }
 
     ScRange aRange(rRange);
+    aRange.Justify();
     SCTAB nTabSpan = aRange.aEnd.Tab() - aRange.aStart.Tab();
 
     vector<ScExternalRefCache::SingleRangeData> aCacheData;