diff options
| author | Luboš Luňák <l.lunak@collabora.com> | 2020-05-07 13:43:05 +0200 |
|---|---|---|
| committer | Noel Grandin <noel.grandin@collabora.co.uk> | 2020-05-10 09:56:03 +0200 |
| commit | 3d0d78621b29fba0e95dc5b348d20bfd3234ebd3 (patch) | |
| tree | 10fe1068be8a276e947f082388dd7e6f2ecb9b04 | |
| parent | 32c616cf2f7c458eefc88d9b94f11d9a7f356293 (diff) | |
sanitize properly Calc search bounds (tdf#132783)
The row/col handling seems really weird to me here in some places
(like starting actually at startcol+1 in some cases). But at least
properly limit the values to prevent out-of-bounds accesses.
This also reverts 2670e980c7dbadbdc20ff23d57ad892951edc254.
Change-Id: I5eb94f3841f3defa763046d5d5bec805abd97c62
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93634
Tested-by: Jenkins
Reviewed-by: Luboš Luňák <l.lunak@collabora.com>
(cherry picked from commit 58c87f8261abf4f1528a43dc501e956cb9c1d2f2)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93543
Tested-by: Noel Grandin <noel.grandin@collabora.co.uk>
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
| -rw-r--r-- | sc/source/core/data/table6.cxx | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/sc/source/core/data/table6.cxx b/sc/source/core/data/table6.cxx index ecaf800b0c27..17fd7c874c47 100644 --- a/sc/source/core/data/table6.cxx +++ b/sc/source/core/data/table6.cxx @@ -328,17 +328,17 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem, SCCOL& rCol, SCROW& rRow, bool bSkipFiltered = !rSearchItem.IsSearchFiltered(); bool bSearchNotes = (rSearchItem.GetCellType() == SvxSearchCellType::NOTE); // We need to cache sc::ColumnBlockConstPosition per each column. - std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 2 ); - for( SCCOL i = 0; i <= nLastCol+1; ++i ) + std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 1 ); + for( SCCOL i = 0; i <= nLastCol; ++i ) aCol[ i ].InitBlockPosition( blockPos[ i ] ); if (!bAll && rSearchItem.GetBackward()) { SCROW nLastNonFilteredRow = pDocument->MaxRow() + 1; - nCol = std::min(nCol, static_cast<SCCOL>(nLastCol + 1)); - nRow = std::min(nRow, static_cast<SCROW>(nLastRow + 1)); if (rSearchItem.GetRowDirection()) { nCol--; + nCol = std::min(nCol, nLastCol); + nRow = std::min(nRow, nLastRow); while (!bFound && (nRow >= 0)) { if (bSkipFiltered) @@ -377,6 +377,8 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem, SCCOL& rCol, SCROW& rRow, else { nRow--; + nCol = std::min(nCol, nLastCol); + nRow = std::min(nRow, nLastRow); while (!bFound && (nCol >= 0)) { while (!bFound && (nRow >= 0)) |