[Libreoffice] [REVIEW] patch for fdo#41022 Activation Order Crashes Address Database

[Petr Mladek]

Hi Julien,

you rock that you tracked it down to the problematic code.

julien2412 píše v So 22. 10. 2011 v 07:34 -0700:
> Hello,
> 
> I propose the patch attached to correct the bug.
> I had put the backtrace of the error in the tracker.
> 
> It compiles ok and it doesn't crash. It seems to respect the order of the
> fields we can see (cf the attached file of the tracker) 
> 
> I fixed the comparison operator too cause when you clicked several times,
> the order is changed for 2 fields each time and for always the same 2
> fields.
> 
> http://nabble.documentfoundation.org/file/n3443648/patch_fdo41022.txt
> patch_fdo41022.txt 

I am a bit unsure about the change:

-            if ( pEntry->aPos.Y() >= pE->aPos.Y() ) 
+            if ( pEntry->aPos.Y() > pE->aPos.Y() ) 

It means that the following while cycle newer happens because it checks
for:

              pEntry->aPos.Y() == pE->aPos.Y()


The following change would make more sense:

-            if ( pEntry->aPos.Y() >= pE->aPos.Y() ) 
+            if ( pEntry->aPos.Y() == pE->aPos.Y() )

or we need to somehow update the check in that while cycle.
		

Otherwise, the most important change should be the added check:

	 "nPos < aCtrls.size()"

It makes sure that pEntry->aPos.Y() is not called with invalid pEntry
pointer, so it avoids the crash.

Could you please test the attached patch? You might apply it using:
 
   git am 0001-activation-order-crashes-address-database-fdo-41022.patch


Takes a lot for looking at the bug. You are great because you did the
hard work to find the problematic piece of code!


Best Regards,
Petr