[Libreoffice-commits] core.git: Branch 'libreoffice-6-4' - sc/source

[Luboš Luňák (via logerrit)]

 sc/source/core/tool/interpr1.cxx |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

New commits:
commit f86ba65165bdb208c55f847d35113dbbbe195301
Author:     Luboš Luňák <l.lunak at collabora.com>
AuthorDate: Tue Jun 9 10:45:10 2020 +0200
Commit:     Xisco Fauli <xiscofauli at libreoffice.org>
CommitDate: Thu Jun 18 11:21:41 2020 +0200

    detect inconsistent SUMIFS() ranges when range reducing (tdf#132431)
    
    03b352b9599514e4e244e1907510713cf1331284 introduced reducing
    of the SUMIFS range to the cells that actually contain data, but
    tdf#132431 introduces incorrect ranges that lead to negative indexes,
    and correctness checking of ranges comes only after the use of these
    indexes.
    
    Change-Id: Ia13db83d222310d470a0a8ecef51dbdd7992d479
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/95898
    Tested-by: Jenkins
    Reviewed-by: Luboš Luňák <l.lunak at collabora.com>
    (cherry picked from commit 707cd62e00a75f5a07ef3a4acf5df9d49e8e07c1)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96030
    Reviewed-by: Xisco Fauli <xiscofauli at libreoffice.org>
    (cherry picked from commit 07d3f573a6fb3556b90bbba979454ece91ae5a07)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96043

diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
index 9069138c3013..e375f1626ec5 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -5849,6 +5849,7 @@ void ScInterpreter::IterateParametersIfs( double(*ResultFunc)( const sc::ParamIf
     SCROW nStartRowDiff = 0;
     SCROW nEndRowDiff = 0;
     bool bRangeReduce = false;
+    ScRange aMainRange;
 
     // Range-reduce optimization
     if (nParamCount % 2) // Not COUNTIFS
@@ -5872,7 +5873,7 @@ void ScInterpreter::IterateParametersIfs( double(*ResultFunc)( const sc::ParamIf
             const ScComplexRefData* pRefData = pMainRangeToken->GetDoubleRef();
             if (!pRefData->IsDeleted())
             {
-                ScRange aMainRange, aSubRange;
+                ScRange aSubRange;
                 DoubleRefToRange( *pRefData, aMainRange);
 
                 if (aMainRange.aStart.Tab() == aMainRange.aEnd.Tab())
@@ -6076,6 +6077,13 @@ void ScInterpreter::IterateParametersIfs( double(*ResultFunc)( const sc::ParamIf
 
             if (bRangeReduce)
             {
+                // All reference ranges must be of the same size as the main range.
+                if( aMainRange.aEnd.Col() - aMainRange.aStart.Col() != nCol2 - nCol1
+                    || aMainRange.aEnd.Row() - aMainRange.aStart.Row() != nRow2 - nRow1)
+                {
+                    PushError ( FormulaError::IllegalArgument);
+                    return;
+                }
                 nCol1 += nStartColDiff;
                 nRow1 += nStartRowDiff;