[Libreoffice-commits] core.git: sc/source

[Luboš Luňák (via logerrit)]

 sc/source/core/data/table6.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit 58c87f8261abf4f1528a43dc501e956cb9c1d2f2
Author:     Luboš Luňák <l.lunak at collabora.com>
AuthorDate: Thu May 7 13:43:05 2020 +0200
Commit:     Luboš Luňák <l.lunak at collabora.com>
CommitDate: Thu May 7 15:34:53 2020 +0200

    sanitize properly Calc search bounds (tdf#132097)
    
    The row/col handling seems really weird to me here in some places
    (like starting actually at startcol+1 in some cases). But at least
    properly limit the values to prevent out-of-bounds accesses.
    This also reverts 2670e980c7dbadbdc20ff23d57ad892951edc254.
    
    Change-Id: I5eb94f3841f3defa763046d5d5bec805abd97c62
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93634
    Tested-by: Jenkins
    Reviewed-by: Luboš Luňák <l.lunak at collabora.com>

diff --git a/sc/source/core/data/table6.cxx b/sc/source/core/data/table6.cxx
index a66822fcb9da..0605fa5683a4 100644
--- a/sc/source/core/data/table6.cxx
+++ b/sc/source/core/data/table6.cxx
@@ -339,17 +339,17 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem, SCCOL& rCol, SCROW& rRow,
     bool bSkipFiltered = !rSearchItem.IsSearchFiltered();
     bool bSearchNotes = (rSearchItem.GetCellType() == SvxSearchCellType::NOTE);
     // We need to cache sc::ColumnBlockConstPosition per each column.
-    std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 2 );
-    for( SCCOL i = 0; i <= nLastCol+1; ++i )
+    std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 1 );
+    for( SCCOL i = 0; i <= nLastCol; ++i )
         aCol[ i ].InitBlockPosition( blockPos[ i ] );
     if (!bAll && rSearchItem.GetBackward())
     {
         SCROW nLastNonFilteredRow = pDocument->MaxRow() + 1;
-        nCol = std::min(nCol, static_cast<SCCOL>(nLastCol + 1));
-        nRow = std::min(nRow, static_cast<SCROW>(nLastRow + 1));
         if (rSearchItem.GetRowDirection())
         {
             nCol--;
+            nCol = std::min(nCol, nLastCol);
+            nRow = std::min(nRow, nLastRow);
             while (!bFound && (nRow >= 0))
             {
                 if (bSkipFiltered)
@@ -388,6 +388,8 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem, SCCOL& rCol, SCROW& rRow,
         else
         {
             nRow--;
+            nCol = std::min(nCol, nLastCol);
+            nRow = std::min(nRow, nLastRow);
             while (!bFound && (nCol >= 0))
             {
                 while (!bFound && (nRow >= 0))