[Libreoffice-commits] core.git: sc/source

[Caolán McNamara]

 sc/source/core/tool/scmatrix.cxx |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

New commits:
commit ddeca090ba612cdd5a2d55785fb1c4b66b6bc0a5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Dec 18 16:29:21 2015 +0000

    crashtesting: crash on converting ooo93489-1.ods to pdf
    
    with --headless --convert-to pdf ooo93489-1.ods
    
    probable regression from...
    
    commit d4daad185e9583bedbb5a4eef1fd53e1f22e219b
    Author: Jan Holesovsky <kendy at collabora.com>
    Date:   Mon Nov 30 10:28:43 2015 +0100
    
        sc interpreter: Move the code that can create a ScFullMatrix.
    
    In that original code I see there was a check for "Data array is shorter than
    the row size of the reference. Truncate it to the data" which doesn't exist
    anymore. If I reintroduce that check here the crash is avoided.
    
    Change-Id: I7c7a5979d9c14c133b05e89ce3794e6b739ca61c
    Reviewed-on: https://gerrit.libreoffice.org/20794
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>

diff --git a/sc/source/core/tool/scmatrix.cxx b/sc/source/core/tool/scmatrix.cxx
index 881cb81..ec87836 100644
--- a/sc/source/core/tool/scmatrix.cxx
+++ b/sc/source/core/tool/scmatrix.cxx
@@ -2994,6 +2994,16 @@ void ScVectorRefMatrix::ensureFullMatrix()
     size_t nColSize = rArrays.size();
     mpFullMatrix.reset(new ScFullMatrix(nColSize, mnRowSize));
 
+    size_t nRowSize = mnRowSize;
+    size_t nRowEnd = mnRowStart + mnRowSize;
+    size_t nDataRowEnd = mpToken->GetArrayLength();
+    if (nRowEnd > nDataRowEnd)
+    {
+        // Data array is shorter than the row size of the reference. Truncate
+        // it to the data.
+        nRowSize -= nRowEnd - nDataRowEnd;
+    }
+
     for (size_t nCol = 0; nCol < nColSize; ++nCol)
     {
         const formula::VectorRefArray& rArray = rArrays[nCol];
@@ -3006,14 +3016,14 @@ void ScVectorRefMatrix::ensureFullMatrix()
                 pNums += mnRowStart;
                 rtl_uString** pStrs = rArray.mpStringArray;
                 pStrs += mnRowStart;
-                fillMatrix(*mpFullMatrix, nCol, pNums, pStrs, mnRowSize);
+                fillMatrix(*mpFullMatrix, nCol, pNums, pStrs, nRowSize);
             }
             else
             {
                 // String cells only.
                 rtl_uString** pStrs = rArray.mpStringArray;
                 pStrs += mnRowStart;
-                fillMatrix(*mpFullMatrix, nCol, pStrs, mnRowSize);
+                fillMatrix(*mpFullMatrix, nCol, pStrs, nRowSize);
             }
         }
         else if (rArray.mpNumericArray)
@@ -3021,7 +3031,7 @@ void ScVectorRefMatrix::ensureFullMatrix()
             // Numeric cells only.
             const double* pNums = rArray.mpNumericArray;
             pNums += mnRowStart;
-            fillMatrix(*mpFullMatrix, nCol, pNums, mnRowSize);
+            fillMatrix(*mpFullMatrix, nCol, pNums, nRowSize);
         }
     }
 }