[Libreoffice-commits] core.git: Branch 'private/swe/libreoffice-5-2+backports' - 3 commits - sc/source

[Samuel Mehrbrodt]

 sc/source/filter/xml/xmlcondformat.cxx |   24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

New commits:
commit a21fa202e1fc0684fce2d8aa4e2dd1f86e7e9237
Author: Samuel Mehrbrodt <Samuel.Mehrbrodt at cib.de>
Date:   Tue Apr 24 10:39:44 2018 +0200

    Prevent crash while loading conditional formatting
    
    Manually cherry-picked from 2b0ff1adeb13efbf7fb0f46939738e3f895d7caf
    
    Change-Id: I48734ebdeab552f9f071dbd92ca9b286006cb075

diff --git a/sc/source/filter/xml/xmlcondformat.cxx b/sc/source/filter/xml/xmlcondformat.cxx
index 3917e25f1cb0..997a44f8b537 100644
--- a/sc/source/filter/xml/xmlcondformat.cxx
+++ b/sc/source/filter/xml/xmlcondformat.cxx
@@ -232,9 +232,10 @@ void ScXMLConditionalFormatContext::EndElement()
     for (size_t nFormatEntryIx = 0; nFormatEntryIx < pFormat->size(); ++nFormatEntryIx)
     {
         auto pFormatEntry = pFormat->GetEntry(nFormatEntryIx);
-        auto pCondFormatEntry = static_cast<const ScCondFormatEntry*>(pFormatEntry);
+        auto pCondFormatEntry = dynamic_cast<const ScCondFormatEntry*>(pFormatEntry);
 
-        if (pCondFormatEntry->GetOperation() != SC_COND_EQUAL &&
+        if (pCondFormatEntry == nullptr ||
+            pCondFormatEntry->GetOperation() != SC_COND_EQUAL &&
             pCondFormatEntry->GetOperation() != SC_COND_DIRECT)
         {
             bEligibleForCache = false;
commit 7ab0ddd29fa404ff4bcdf0159de8820fa0c147ff
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Dec 7 16:37:13 2017 +0000

    coverity#1425723 silence 'Wrapper object use after free'
    
    Reviewed-on: https://gerrit.libreoffice.org/46035
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 05f97ef127ec6ee0cc159fc74b4fecc34d9c684c)
    
    Change-Id: Ibcc0e5f28910bdd15c94579d754de3698ac8beb1

diff --git a/sc/source/filter/xml/xmlcondformat.cxx b/sc/source/filter/xml/xmlcondformat.cxx
index f87b077d2436..3917e25f1cb0 100644
--- a/sc/source/filter/xml/xmlcondformat.cxx
+++ b/sc/source/filter/xml/xmlcondformat.cxx
@@ -324,7 +324,16 @@ void ScXMLConditionalFormatContext::EndElement()
                 }
             }
         }
+    }
+
+    sal_uLong nIndex = pDoc->AddCondFormat(pFormat.release(), nTab);
+    ScConditionalFormat* pInsertedFormat = pDoc->GetCondFormList(nTab)->GetFormat(nIndex);
+    assert(pInsertedFormat && pInsertedFormat->GetKey() == nIndex);
 
+    mrParent.mvCondFormatData.push_back( { pInsertedFormat, nTab } );
+
+    if (bEligibleForCache)
+    {
         // Not found in cache, replace oldest cache entry
         sal_Int64 nOldestAge = -1;
         size_t nIndexOfOldest = 0;
@@ -336,17 +345,11 @@ void ScXMLConditionalFormatContext::EndElement()
                 nIndexOfOldest = (&aCacheEntry - &mrParent.maCache.front());
             }
         }
-        mrParent.maCache[nIndexOfOldest].mpFormat = pFormat.get();
+        mrParent.maCache[nIndexOfOldest].mpFormat = pInsertedFormat;
         mrParent.maCache[nIndexOfOldest].mbSingleRelativeReference = bSingleRelativeReference;
         mrParent.maCache[nIndexOfOldest].mpTokens.reset(pTokens);
         mrParent.maCache[nIndexOfOldest].mnAge = 0;
     }
-
-    sal_uLong nIndex = pDoc->AddCondFormat(pFormat.get(), nTab);
-    (void) nIndex; // Avoid 'unused variable' warning when assert() expands to empty
-    assert(pFormat->GetKey() == nIndex);
-
-    mrParent.mvCondFormatData.push_back( { pFormat.release(), nTab } );
 }
 
 ScXMLConditionalFormatContext::~ScXMLConditionalFormatContext()
commit eeab6a64ed28515040e9f419d98feddbb10be388
Author: Mike Kaganski <mike.kaganski at collabora.com>
Date:   Sat Dec 2 20:33:38 2017 +0200

    Don't leak formats that get merged
    
    ea55492a6e55290d92a59324b3cb31ed958981ab follow-up
    
    Change-Id: Ib94a5a2c2ef6ebc7552c67975683dc18a9a5a744
    Reviewed-on: https://gerrit.libreoffice.org/45723
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Mike Kaganski <mike.kaganski at collabora.com>
    (cherry picked from commit 8c89cfe3cdf6595d5f3bb87ecc45b9f450195aac)

diff --git a/sc/source/filter/xml/xmlcondformat.cxx b/sc/source/filter/xml/xmlcondformat.cxx
index f9704a1afb09..f87b077d2436 100644
--- a/sc/source/filter/xml/xmlcondformat.cxx
+++ b/sc/source/filter/xml/xmlcondformat.cxx
@@ -223,7 +223,7 @@ void ScXMLConditionalFormatContext::EndElement()
     ScDocument* pDoc = GetScImport().GetDocument();
 
     SCTAB nTab = GetScImport().GetTables().GetCurrentSheet();
-    ScConditionalFormat* pFormat = mxFormat.release();
+    std::unique_ptr<ScConditionalFormat> pFormat(std::move(mxFormat));
 
     bool bEligibleForCache = true;
     bool bSingleRelativeReference = false;
@@ -336,17 +336,17 @@ void ScXMLConditionalFormatContext::EndElement()
                 nIndexOfOldest = (&aCacheEntry - &mrParent.maCache.front());
             }
         }
-        mrParent.maCache[nIndexOfOldest].mpFormat = pFormat;
+        mrParent.maCache[nIndexOfOldest].mpFormat = pFormat.get();
         mrParent.maCache[nIndexOfOldest].mbSingleRelativeReference = bSingleRelativeReference;
         mrParent.maCache[nIndexOfOldest].mpTokens.reset(pTokens);
         mrParent.maCache[nIndexOfOldest].mnAge = 0;
     }
 
-    sal_uLong nIndex = pDoc->AddCondFormat(pFormat, nTab);
+    sal_uLong nIndex = pDoc->AddCondFormat(pFormat.get(), nTab);
     (void) nIndex; // Avoid 'unused variable' warning when assert() expands to empty
     assert(pFormat->GetKey() == nIndex);
 
-    mrParent.mvCondFormatData.push_back( { pFormat, nTab } );
+    mrParent.mvCondFormatData.push_back( { pFormat.release(), nTab } );
 }
 
 ScXMLConditionalFormatContext::~ScXMLConditionalFormatContext()