crash when modifying a defined name (and other places as well)

In ScRangeName::insert() the underlying
::boost::ptr_set_adapter::insert(p) takes ownerwhip of p and in the case
it can't insert it deletes the object. So, if ScRangeName::insert()
returns false the object where p pointed to is gone.

Adapted various places.

10 files changed, 28 insertions, 25 deletions

diff --git a/sc/inc/rangenam.hxx b/sc/inc/rangenam.hxx
index 5d65bf5876b7..2774028334af 100644
--- a/sc/inc/rangenam.hxx
+++ b/sc/inc/rangenam.hxx
@@ -210,7 +210,14 @@ public:
     SC_DLLPUBLIC iterator end();
     SC_DLLPUBLIC size_t size() const;
     bool empty() const;
+
+    /** Insert object into set if not a duplicate.
+        @ATTENTION: The underlying ::boost::ptr_set_adapter::insert(p) takes
+        ownership of p and if it can't insert it deletes the object! So, if
+        this insert here returns false the object where p pointed to is gone!
+     */
     SC_DLLPUBLIC bool insert(ScRangeData* p);
+
     void erase(const ScRangeData& r);
     void erase(const iterator& itr);
     void clear();
diff --git a/sc/source/core/data/documen2.cxx b/sc/source/core/data/documen2.cxx
index c85f45019ccc..a08865ec12a3 100644
--- a/sc/source/core/data/documen2.cxx
+++ b/sc/source/core/data/documen2.cxx
@@ -1022,7 +1022,7 @@ sal_uLong ScDocument::TransferTab( ScDocument* pSrcDoc, SCTAB nSrcPos,
                             if (!pRangeName->insert(pData))
                             {
                                 OSL_FAIL("can't insert name");     // shouldn't happen
-                                delete pData;
+                                pData = NULL;
                             }
                             else
                             {
diff --git a/sc/source/core/data/document.cxx b/sc/source/core/data/document.cxx
index 0f53226f47c1..8de3fbbcc9f2 100644
--- a/sc/source/core/data/document.cxx
+++ b/sc/source/core/data/document.cxx
@@ -1971,9 +1971,7 @@ void ScDocument::TransposeClip( ScDocument* pTransClip, sal_uInt16 nFlags, sal_B
         {
             sal_uInt16 nIndex = itr->GetIndex();
             ScRangeData* pData = new ScRangeData(*itr);
-            if (!pTransClip->pRangeName->insert(pData))
-                delete pData;
-            else
+            if (pTransClip->pRangeName->insert(pData))
                 pData->SetIndex(nIndex);
         }
     }
@@ -2036,9 +2034,7 @@ void copyUsedNamesToClip(ScRangeName* pClipRangeName, ScRangeName* pRangeName, c
             continue;
 
         ScRangeData* pData = new ScRangeData(*itr);
-        if (!pClipRangeName->insert(pData))
-            delete pData;
-        else
+        if (pClipRangeName->insert(pData))
             pData->SetIndex(nIndex);
     }
 }
@@ -2147,7 +2143,7 @@ void ScDocument::CopyRangeNamesFromClip(ScDocument* pClipDoc, ScClipRangeNameDat
             }
             else
             {   // must be an overflow
-                delete pData;
+                pData = NULL;
                 aClipRangeNames.insert(itr->GetIndex(), 0);
                 aClipRangeNames.mbReplace = true;
             }
diff --git a/sc/source/filter/excel/xiname.cxx b/sc/source/filter/excel/xiname.cxx
index 1b3b56f4c120..2d36e462298d 100644
--- a/sc/source/filter/excel/xiname.cxx
+++ b/sc/source/filter/excel/xiname.cxx
@@ -216,14 +216,20 @@ XclImpName::XclImpName( XclImpStream& rStrm, sal_uInt16 nXclNameIdx ) :
         pData->GuessPosition();             // calculate base position for relative refs
         pData->SetIndex( nXclNameIdx );     // used as unique identifier in formulas
         if (nXclTab == EXC_NAME_GLOBAL)
-            GetDoc().GetRangeName()->insert(pData);
+        {
+            if (!GetDoc().GetRangeName()->insert(pData))
+                pData = NULL;
+        }
         else
         {
             ScRangeName* pLocalNames = GetDoc().GetRangeName(mnScTab);
             if (pLocalNames)
-                pLocalNames->insert(pData);
+            {
+                if (!pLocalNames->insert(pData))
+                    pData = NULL;
+            }
 
-            if (GetBiff() == EXC_BIFF8)
+            if (GetBiff() == EXC_BIFF8 && pData)
             {
                 ScRange aRange;
                 // discard deleted ranges ( for the moment at least )
@@ -233,7 +239,8 @@ XclImpName::XclImpName( XclImpStream& rStrm, sal_uInt16 nXclNameIdx ) :
                 }
             }
         }
-        mpScData = pData;                   // cache for later use
+        if (pData)
+            mpScData = pData;               // cache for later use
     }
 }
 
diff --git a/sc/source/filter/html/htmlimp.cxx b/sc/source/filter/html/htmlimp.cxx
index 4b2b1dc54ebe..52eb9de3528d 100644
--- a/sc/source/filter/html/htmlimp.cxx
+++ b/sc/source/filter/html/htmlimp.cxx
@@ -132,8 +132,7 @@ void ScHTMLImport::InsertRangeName( ScDocument* pDoc, const String& rName, const
     ScTokenArray aTokArray;
     aTokArray.AddDoubleReference( aRefData );
     ScRangeData* pRangeData = new ScRangeData( pDoc, rName, aTokArray );
-    if( !pDoc->GetRangeName()->insert( pRangeData ) )
-        delete pRangeData;
+    pDoc->GetRangeName()->insert( pRangeData );
 }
 
 void ScHTMLImport::WriteToDocument(
diff --git a/sc/source/ui/app/inputwin.cxx b/sc/source/ui/app/inputwin.cxx
index 401d68c44c45..e8edcbed86ed 100644
--- a/sc/source/ui/app/inputwin.cxx
+++ b/sc/source/ui/app/inputwin.cxx
@@ -1940,8 +1940,6 @@ void ScPosWnd::DoEnter()
                             aFunc.ModifyRangeNames( aNewRanges );
                             pViewSh->UpdateInputHandler(true);
                         }
-                        else
-                            delete pNew;        // shouldn't happen
                     }
                 }
                 else
diff --git a/sc/source/ui/docshell/docfunc.cxx b/sc/source/ui/docshell/docfunc.cxx
index 0d531927a4cd..7fd656b41bc6 100644
--- a/sc/source/ui/docshell/docfunc.cxx
+++ b/sc/source/ui/docshell/docfunc.cxx
@@ -4598,7 +4598,6 @@ void ScDocFunc::CreateOneName( ScRangeName& rList,
                 if (!rList.insert(pData))
                 {
                     OSL_FAIL("nanu?");
-                    delete pData;
                 }
             }
         }
diff --git a/sc/source/ui/namedlg/namedlg.cxx b/sc/source/ui/namedlg/namedlg.cxx
index 89fd95cc49ba..e42dee1d50f3 100644
--- a/sc/source/ui/namedlg/namedlg.cxx
+++ b/sc/source/ui/namedlg/namedlg.cxx
@@ -388,8 +388,7 @@ bool ScNameDlg::AddPushed()
                 //    in ein Token-Array uebersetzt werden?)
                 if ( 0 == pNewEntry->GetErrCode() )
                 {
-                    rtl::OUString aUpper = aNewEntry;
-                    aUpper.toAsciiUpperCase();
+                    rtl::OUString aUpper( ScGlobal::pCharClass->upper( aNewEntry));
                     ScRangeData* pData = mpCurRangeName->findByUpperName(aUpper);
                     if (pData)
                     {
@@ -400,7 +399,7 @@ bool ScNameDlg::AddPushed()
                         mpImpl->Clear();
 
                     if ( !mpCurRangeName->insert( pNewEntry ) )
-                        delete pNewEntry;
+                        pNewEntry = NULL;
 
                     UpdateNames();
                     bSaved=false;
diff --git a/sc/source/ui/unoobj/nameuno.cxx b/sc/source/ui/unoobj/nameuno.cxx
index 5c25834f3f92..aed65767a839 100644
--- a/sc/source/ui/unoobj/nameuno.cxx
+++ b/sc/source/ui/unoobj/nameuno.cxx
@@ -194,7 +194,7 @@ void ScNamedRangeObj::Modify_Impl( const String* pNewName, const ScTokenArray* p
     }
     else
     {
-        delete pNew;        //! uno::Exception/Fehler oder so
+        pNew = NULL;        //! uno::Exception/Fehler oder so
         delete pNewRanges;
     }
 }
@@ -573,7 +573,7 @@ void SAL_CALL ScNamedRangesObj::addNewByName( const rtl::OUString& aName,
             }
             else
             {
-                delete pNew;
+                pNew = NULL;
                 delete pNewRanges;
             }
         }
diff --git a/sc/source/ui/view/viewfunc.cxx b/sc/source/ui/view/viewfunc.cxx
index 34a34b9c26af..5bd56f919fac 100644
--- a/sc/source/ui/view/viewfunc.cxx
+++ b/sc/source/ui/view/viewfunc.cxx
@@ -2935,10 +2935,8 @@ sal_Bool ScViewFunc::InsertName( const String& rName, const String& rSymbol,
         }
 
         if ( pList->insert( pNewEntry ) )
-        {
-            pNewEntry = NULL;   // nicht loeschen
             bOk = sal_True;
-        }
+        pNewEntry = NULL;   // never delete, insert took ownership
 
         pDoc->CompileNameFormula( false );  // CompileFormulaString
         aModificator.SetDocumentModified();