diff options
| author | Eike Rathke <erack@redhat.com> | 2014-03-17 13:50:20 +0100 |
|---|---|---|
| committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2014-03-17 13:37:48 +0000 |
| commit | cc605367d4f135adc815582900794f0cfdb88aa7 (patch) | |
| tree | ed8d8875182efa7672a28f6a5ce798296dc4bc7a | |
| parent | 2b54ede7e2c3b4f2c0baeb53bb798f507ba15719 (diff) | |
justify range to prevent negative tab span and memory alloc, rhbz#1057741
I could not reproduce the crash of that bug (probably having more memory
available), but the backtrace had nTabSpan = -2 implicitly casted to
size_t leading to allocation of a huge amount of memory with
vector::reserve(), which ScRange::Justify() exactly prevents.
Change-Id: Idb79e1be62649922ba793cab01e00011479fade9
(cherry picked from commit a45fde7235f95792bf8e6f6979d0040637c5785d)
Reviewed-on: https://gerrit.libreoffice.org/8625
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
| -rw-r--r-- | sc/source/ui/docshell/externalrefmgr.cxx | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sc/source/ui/docshell/externalrefmgr.cxx b/sc/source/ui/docshell/externalrefmgr.cxx index 8b5b40d9eb25..3e142eb51f34 100644 --- a/sc/source/ui/docshell/externalrefmgr.cxx +++ b/sc/source/ui/docshell/externalrefmgr.cxx @@ -1927,6 +1927,7 @@ ScExternalRefCache::TokenArrayRef ScExternalRefManager::getDoubleRefTokensFromSr } ScRange aRange(rRange); + aRange.Justify(); SCTAB nTabSpan = aRange.aEnd.Tab() - aRange.aStart.Tab(); vector<ScExternalRefCache::SingleRangeData> aCacheData; |