Integer overflow in Calc lcl_getSingleCellAddressFromXMLString nColumn computation

Stephan Bergmann sbergman at
Tue Feb 23 10:08:22 UTC 2021

On 23/02/2021 08:34, Stephan Bergmann wrote:
> I have no idea whether lcl_getSingleCellAddressFromXMLString is 
> legitimately getting called here with those arguments (or if the real 
> error is somewhere else), what that nColumn computation actually means, 
> nor what's going on in general.  If anybody knowledgeable about that 
> code could please have a look.

With a little more digging:  However sc/qa/uitest/data/tdf107097.ods was 
generated, its "Object 1/content.xml" sub-file contains the XML element

> <chart:plot-area chart:style-name="ch3" table:cell-range-address="PivotChart" chart:data-source-has-labels="column" svg:x="0.398cm" svg:y="0.991cm" svg:width="16.013cm" svg:height="9.381cm">

whose table:cell-range-address attribute appears to what gets processed 

"19.593.6<chart:plot-area> (deprecated)" specifies that that attribute 
shall be of type 
"18.3.6cellRangeAddressList" aka 
"9.2.5Cell Range Address List".  Lacking whitespace, "PivotChart" is 
apparently a list containing a single cell range addresses or cell 
addresses, and lacking a colon, it apparently is a cell address.

"Referencing Table Cells" specifies the structure of such a cell address:

> Cell addresses are constructed as follows:
>     1)The name of the table. 
>     2)A dot “.” (U+002E, FULL STOP). 
>     3)An alphabetic value representing the column. The letter A represents column 1, B represents column 2, and so on. AA represents column 27, AB represents column 28, and so on. 
>     4)A numeric value representing the row. The number 1 represents the first row, the number 2 represents the second row, and so on.

But lcl_getCellAddressFromXMLString and 
lcl_getSingleCellAddressFromXMLString in 
chart2/source/tools/XMLRangeHelper.cxx apparently attempt to parse 
something rather different:

* lcl_getCellAddressFromXMLString supports backslash quoting;

* lcl_getCellAddressFromXMLString makes the leading table name and dot 

* lcl_getSingleCellAddressFromXMLString supports an optional "$";

* lcl_getSingleCellAddressFromXMLString supports lower-case letters in 
addition to upper-case letters for the column;

* lcl_getSingleCellAddressFromXMLString makes the numeric value 
representing the row optional.

I'm still not sure what to make of all that.  Is 
sc/qa/uitest/data/tdf107097.ods bogus and should be rejected?  Xisco, 
can you please clarify how you created that file?  Should the parsing 
code in chart2/source/tools/XMLRangeHelper.cxx be less lenient and 
reject that "PivotChart" value (or is that parsing code also used in 
situations that ask for parsing another grammar)?

More information about the LibreOffice mailing list