[Libreoffice-commits] core.git: sc/source

[Eike Rathke]

 sc/source/ui/docshell/externalrefmgr.cxx |   49 +++++++++++++++++++++----------
 1 file changed, 34 insertions(+), 15 deletions(-)

New commits:
commit 9cae3a88587deaf22ee83b2e36487013a1220a3b
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Mar 8 11:05:34 2016 +0100

    setCellRangeData: check matrix size before operating, tdf#98389 follow-up
    
    Now that we can have the one element error matrix we can't blindly call
    ExecuteOperation() on it that would access elements out of bounds.
    
    Change-Id: Ib6e5525f685c9324235f128a943dd716ea7a3fca

diff --git a/sc/source/ui/docshell/externalrefmgr.cxx b/sc/source/ui/docshell/externalrefmgr.cxx
index 28c8fb0..8319e5e 100644
--- a/sc/source/ui/docshell/externalrefmgr.cxx
+++ b/sc/source/ui/docshell/externalrefmgr.cxx
@@ -853,23 +853,42 @@ void ScExternalRefCache::setCellRangeData(sal_uInt16 nFileId, const ScRange& rRa
             pTabData.reset(new Table);
 
         const ScMatrixRef& pMat = itrData->mpRangeData;
-        ScFullMatrix::DoubleOpFunction aDoubleFunc = [=](size_t row, size_t col, double val) -> void
-        {
-            pTabData->setCell(col + nCol1, row + nRow1, new formula::FormulaDoubleToken(val), 0, false);
-        };
-        ScFullMatrix::BoolOpFunction aBoolFunc = [=](size_t row, size_t col, bool val) -> void
+        SCSIZE nMatCols, nMatRows;
+        pMat->GetDimensions( nMatCols, nMatRows);
+        if (nMatCols > static_cast<SCSIZE>(nCol2 - nCol1) && nMatRows > static_cast<SCSIZE>(nRow2 - nRow1))
         {
-            pTabData->setCell(col + nCol1, row + nRow1, new formula::FormulaDoubleToken(val ? 1.0 : 0.0), 0, false);
-        };
-        ScFullMatrix::StringOpFunction aStringFunc = [=](size_t row, size_t col, svl::SharedString val) -> void
+            ScFullMatrix::DoubleOpFunction aDoubleFunc = [=](size_t row, size_t col, double val) -> void
+            {
+                pTabData->setCell(col + nCol1, row + nRow1, new formula::FormulaDoubleToken(val), 0, false);
+            };
+            ScFullMatrix::BoolOpFunction aBoolFunc = [=](size_t row, size_t col, bool val) -> void
+            {
+                pTabData->setCell(col + nCol1, row + nRow1, new formula::FormulaDoubleToken(val ? 1.0 : 0.0), 0, false);
+            };
+            ScFullMatrix::StringOpFunction aStringFunc = [=](size_t row, size_t col, svl::SharedString val) -> void
+            {
+                pTabData->setCell(col + nCol1, row + nRow1, new formula::FormulaStringToken(val), 0, false);
+            };
+            pMat->ExecuteOperation(std::pair<size_t, size_t>(0, 0),
+                    std::pair<size_t, size_t>(nRow2-nRow1, nCol2-nCol1),
+                    aDoubleFunc, aBoolFunc, aStringFunc);
+            // Mark the whole range 'cached'.
+            pTabData->setCachedCellRange(nCol1, nRow1, nCol2, nRow2);
+        }
+        else
         {
-            pTabData->setCell(col + nCol1, row + nRow1, new formula::FormulaStringToken(val), 0, false);
-        };
-        pMat->ExecuteOperation(std::pair<size_t, size_t>(0, 0),
-                std::pair<size_t, size_t>(nRow2-nRow1, nCol2-nCol1),
-                aDoubleFunc, aBoolFunc, aStringFunc);
-        // Mark the whole range 'cached'.
-        pTabData->setCachedCellRange(nCol1, nRow1, nCol2, nRow2);
+            // This may happen due to a matrix not been allocated earlier, in
+            // which case it should have exactly one error element.
+            SAL_WARN("sc.ui","ScExternalRefCache::setCellRangeData - matrix size mismatch");
+            if (nMatCols != 1 || nMatRows != 1)
+                SAL_WARN("sc.ui","ScExternalRefCache::setCellRangeData - not a one element matrix");
+            else
+            {
+                sal_uInt16 nErr = GetDoubleErrorValue( pMat->GetDouble(0,0));
+                SAL_WARN("sc.ui","ScExternalRefCache::setCellRangeData - matrix error value is " << nErr <<
+                        (nErr == errMatrixSize ? ", ok" : ", not ok"));
+            }
+        }
     }
 
     size_t nTabLastId = nTabFirstId + rRange.aEnd.Tab() - rRange.aStart.Tab();