diff options
| author | Eike Rathke <erack@redhat.com> | 2017-02-17 14:10:37 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2017-02-17 14:16:44 +0100 |
| commit | 9bdf971b0202c6d55d88e61861b251459de9586b (patch) | |
| tree | be0d13f96e9f392fece5f0a79c671bce9d323f42 | |
| parent | 684b9de16f41ca7662ed0d848fd63c3c5661d671 (diff) | |
Resolves: tdf#105858 check nDataCount<SC_DPOUT_MAXLEVELS to prevent crash
Change-Id: If9084543a0a191d08da37b5b8a187bce46440871
| -rw-r--r-- | sc/source/core/data/dpoutput.cxx | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/sc/source/core/data/dpoutput.cxx b/sc/source/core/data/dpoutput.cxx index ee3a8bc6b88a..18f57762392b 100644 --- a/sc/source/core/data/dpoutput.cxx +++ b/sc/source/core/data/dpoutput.cxx @@ -344,9 +344,10 @@ void lcl_FillNumberFormats( sal_uInt32*& rFormats, long& rCount, OUString aDataNames[SC_DPOUT_MAXLEVELS]; sal_uInt32 nDataFormats[SC_DPOUT_MAXLEVELS]; - long nDataCount = 0; - long nDimCount = xDims->getCount(); - for (long nDim=0; nDim<nDimCount; nDim++) + size_t nDataCount = 0; + sal_Int32 nDimCount = xDims->getCount(); + sal_Int32 nDim = 0; + for ( ; nDim < nDimCount && nDataCount < SC_DPOUT_MAXLEVELS; nDim++) { uno::Reference<uno::XInterface> xDim = ScUnoHelpFunctions::AnyToInterface( xDims->getByIndex(nDim) ); @@ -369,6 +370,8 @@ void lcl_FillNumberFormats( sal_uInt32*& rFormats, long& rCount, } } } + SAL_WARN_IF( nDim < nDimCount && nDataCount == SC_DPOUT_MAXLEVELS, "sc.core", + "lcl_FillNumberFormats - may have lost an output level due to SC_DPOUT_MAXLEVELS=" << SC_DPOUT_MAXLEVELS); if (!nDataCount) return; @@ -394,7 +397,7 @@ void lcl_FillNumberFormats( sal_uInt32*& rFormats, long& rCount, aName = pArray[nPos].Name; sal_uInt32 nFormat = 0; - for (long i=0; i<nDataCount; i++) + for (size_t i=0; i<nDataCount; i++) if (aName == aDataNames[i]) //TODO: search more efficiently? { nFormat = nDataFormats[i]; |