diff options
author | Kohei Yoshida <kohei.yoshida@gmail.com> | 2013-01-03 15:38:14 -0500 |
---|---|---|
committer | Kohei Yoshida <kohei.yoshida@gmail.com> | 2013-01-03 15:45:16 -0500 |
commit | a39ceea669d964aab16378a7555b07f70d1f069d (patch) | |
tree | b6db0e40e8669c39611c7ca7aa603fff6a68064f | |
parent | 0e213aae481cbf7106bf13350835c9c488b035df (diff) |
fdo#58004: Fix out-of-bound access to std::vector.
Two things were wrong with the old code:
1) it didn't check for out-of-bound access, and
2) used SC_DP_MAX_FIELDS as the upper bound of dimension members, when
in fact SC_DP_MAX_FIELDS was the upper bound of dimensions themselves,.
not their members. We shouldn't impose such upper bounds actually,
at least not in the core implementation. We should do that in the
UI code if we really have to.
Change-Id: I307d4f34d2b0be84f0fd2b93a6270ffce2448bdf
-rw-r--r-- | sc/inc/dptabres.hxx | 2 | ||||
-rw-r--r-- | sc/source/core/data/dptabres.cxx | 24 |
2 files changed, 8 insertions, 18 deletions
diff --git a/sc/inc/dptabres.hxx b/sc/inc/dptabres.hxx index b49ee2c65283..81c3c01ab262 100644 --- a/sc/inc/dptabres.hxx +++ b/sc/inc/dptabres.hxx @@ -294,7 +294,7 @@ private: bool bDataAtRow:1; //! add "displayed values" settings - mutable std::vector< ResultMembers* > mpDimMembers; + mutable std::vector<ResultMembers*> maDimMembers; public: ScDPResultData( ScDPSource* pSrc ); //! Ref ~ScDPResultData(); diff --git a/sc/source/core/data/dptabres.cxx b/sc/source/core/data/dptabres.cxx index 552258705f96..01c256d23c71 100644 --- a/sc/source/core/data/dptabres.cxx +++ b/sc/source/core/data/dptabres.cxx @@ -72,17 +72,7 @@ static sal_uInt16 nFuncStrIds[12] = // passend zum enum ScSubTotalFunc STR_FUN_TEXT_VAR // SUBTOTAL_FUNC_VARP }; namespace { - template < typename T > - void lcl_ResizePointVector( T & vec, size_t nSize ) - { - for ( size_t i = 0 ; i < vec.size(); i++ ) - { - if ( vec[i] ) - delete vec[i]; - } - vec.resize( nSize, NULL ); - } sal_Bool lcl_SearchMember( const std::vector <ScDPResultMember *>& list, SCROW nOrder, SCROW& rIndex) { rIndex = list.size(); @@ -740,8 +730,6 @@ ScDPResultData::ScDPResultData( ScDPSource* pSrc ) : //! Ref bDataAtCol( false ), bDataAtRow( false ) { - - lcl_ResizePointVector( mpDimMembers , SC_DP_MAX_FIELDS ); } ScDPResultData::~ScDPResultData() @@ -750,7 +738,7 @@ ScDPResultData::~ScDPResultData() delete[] pMeasRefs; delete[] pMeasRefOrient; - lcl_ResizePointVector( mpDimMembers , 0 ); + std::for_each(maDimMembers.begin(), maDimMembers.end(), ScDeleteObjectByPtr<ResultMembers>()); } void ScDPResultData::SetMeasureData( long nCount, const ScSubTotalFunc* pFunctions, @@ -924,8 +912,10 @@ const ScDPSource* ScDPResultData::GetSource() const ResultMembers* ScDPResultData::GetDimResultMembers(long nDim, ScDPDimension* pDim, ScDPLevel* pLevel) const { - if (mpDimMembers[nDim]) - return mpDimMembers[nDim]; + if (nDim < static_cast<long>(maDimMembers.size()) && maDimMembers[nDim]) + return maDimMembers[nDim]; + + maDimMembers.resize(nDim+1, NULL); ResultMembers* pResultMembers = new ResultMembers(); // global order is used to initialize aMembers, so it doesn't have to be looked at later @@ -944,8 +934,8 @@ ResultMembers* ScDPResultData::GetDimResultMembers(long nDim, ScDPDimension* pDi } } - mpDimMembers[nDim] = pResultMembers; - return mpDimMembers[nDim]; + maDimMembers[nDim] = pResultMembers; + return maDimMembers[nDim]; } // ----------------------------------------------------------------------- |