From 30cee1ae3e36c5b3bdae71550298abac5abc8788 Mon Sep 17 00:00:00 2001
From: Luboš Luňák <l.lunak@collabora.com>
Date: Mon, 14 May 2018 16:23:52 +0200
Subject: disable also ocStyle for Calc's threading

The ocStyle token is only in the RPN tokens, the raw tokens array contains
only ocName, so it's necessary to check also RPN tokens.

Prevents a crash with tdf#91220/1 because of ScInterpreter::ScStyle() causing
a SfxBroadcaster::Broadcast() call.

Change-Id: I7fa04114b698918569014322c721751ab3d8c62f
Reviewed-on: https://gerrit.libreoffice.org/54326
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Jenkins <ci@libreoffice.org>
---
 formula/source/core/api/FormulaCompiler.cxx | 16 +++++++++++++++-
 formula/source/core/api/token.cxx           | 12 ++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

(limited to 'formula')

diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx
index 96c2e166fe00..f5e06e77deba 100644
--- a/formula/source/core/api/FormulaCompiler.cxx
+++ b/formula/source/core/api/FormulaCompiler.cxx
@@ -712,6 +712,7 @@ FormulaCompiler::FormulaCompiler( FormulaTokenArray& rArr )
         bAutoCorrect( false ),
         bCorrected( false ),
         glSubTotal( false ),
+        needsRPNTokenCheck( false ),
         mbJumpCommandReorder(true),
         mbStopOnError(true)
 {
@@ -734,6 +735,7 @@ FormulaCompiler::FormulaCompiler()
         bAutoCorrect( false ),
         bCorrected( false ),
         glSubTotal( false ),
+        needsRPNTokenCheck( false ),
         mbJumpCommandReorder(true),
         mbStopOnError(true)
 {
@@ -1328,7 +1330,14 @@ bool FormulaCompiler::GetToken()
                 glSubTotal = true;
                 break;
             case ocName:
-                return HandleRange();
+                if( HandleRange())
+                {
+                    // Expanding ocName might have introduced tokens such as ocStyle that prevent formula threading,
+                    // but those wouldn't be present in the raw tokens array, so ensure RPN tokens will be checked too.
+                    needsRPNTokenCheck = true;
+                    return true;
+                }
+                return false;
             case ocColRowName:
                 return HandleColRowName();
             case ocDBArea:
@@ -1980,6 +1989,7 @@ bool FormulaCompiler::CompileTokenArray()
 {
     glSubTotal = false;
     bCorrected = false;
+    needsRPNTokenCheck = false;
     if (pArr->GetCodeError() == FormulaError::NONE || !mbStopOnError)
     {
         if ( bAutoCorrect )
@@ -2013,7 +2023,11 @@ bool FormulaCompiler::CompileTokenArray()
         while( pStack )
             PopTokenArray();
         if( pc )
+        {
             pArr->CreateNewRPNArrayFromData( pData, pc );
+            if( needsRPNTokenCheck )
+                pArr->CheckAllRPNTokens();
+        }
 
         // once an error, always an error
         if( pArr->GetCodeError() == FormulaError::NONE && nErrorBeforePop != FormulaError::NONE )
diff --git a/formula/source/core/api/token.cxx b/formula/source/core/api/token.cxx
index 649a8d36c443..42b19f8543c0 100644
--- a/formula/source/core/api/token.cxx
+++ b/formula/source/core/api/token.cxx
@@ -674,6 +674,18 @@ void FormulaTokenArray::CheckToken( const FormulaToken& /*r*/ )
     // Do nothing.
 }
 
+void FormulaTokenArray::CheckAllRPNTokens()
+{
+    if( nRPN )
+    {
+        FormulaToken** p = pRPN;
+        for( sal_uInt16 i = 0; i < nRPN; i++ )
+        {
+            CheckToken( *p[ i ] );
+        }
+    }
+}
+
 FormulaToken* FormulaTokenArray::AddToken( const FormulaToken& r )
 {
     return Add( r.Clone() );
-- 
cgit