summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKohei Yoshida <kohei.yoshida@gmail.com>2013-01-03 15:38:14 -0500
committerKohei Yoshida <kohei.yoshida@gmail.com>2013-01-03 15:48:17 -0500
commitd385c6379ae7805abec28e30dec6c10fcb1a6006 (patch)
tree28e4e0ef72bfe135cfea75fcc165b46a7442fa84
parente49ce23c354bc3b57c2bc94ff07ba612824c35ad (diff)
fdo#58004: Fix out-of-bound access to std::vector.
Two things were wrong with the old code: 1) it didn't check for out-of-bound access, and 2) used SC_DP_MAX_FIELDS as the upper bound of dimension members, when in fact SC_DP_MAX_FIELDS was the upper bound of dimensions themselves,. not their members. We shouldn't impose such upper bounds actually, at least not in the core implementation. We should do that in the UI code if we really have to. Change-Id: I307d4f34d2b0be84f0fd2b93a6270ffce2448bdf
-rw-r--r--sc/inc/dptabres.hxx2
-rw-r--r--sc/source/core/data/dptabres.cxx24
2 files changed, 8 insertions, 18 deletions
diff --git a/sc/inc/dptabres.hxx b/sc/inc/dptabres.hxx
index b49ee2c65283..81c3c01ab262 100644
--- a/sc/inc/dptabres.hxx
+++ b/sc/inc/dptabres.hxx
@@ -294,7 +294,7 @@ private:
bool bDataAtRow:1;
//! add "displayed values" settings
- mutable std::vector< ResultMembers* > mpDimMembers;
+ mutable std::vector<ResultMembers*> maDimMembers;
public:
ScDPResultData( ScDPSource* pSrc ); //! Ref
~ScDPResultData();
diff --git a/sc/source/core/data/dptabres.cxx b/sc/source/core/data/dptabres.cxx
index 552258705f96..01c256d23c71 100644
--- a/sc/source/core/data/dptabres.cxx
+++ b/sc/source/core/data/dptabres.cxx
@@ -72,17 +72,7 @@ static sal_uInt16 nFuncStrIds[12] = // passend zum enum ScSubTotalFunc
STR_FUN_TEXT_VAR // SUBTOTAL_FUNC_VARP
};
namespace {
- template < typename T >
- void lcl_ResizePointVector( T & vec, size_t nSize )
- {
- for ( size_t i = 0 ; i < vec.size(); i++ )
- {
- if ( vec[i] )
- delete vec[i];
- }
- vec.resize( nSize, NULL );
- }
sal_Bool lcl_SearchMember( const std::vector <ScDPResultMember *>& list, SCROW nOrder, SCROW& rIndex)
{
rIndex = list.size();
@@ -740,8 +730,6 @@ ScDPResultData::ScDPResultData( ScDPSource* pSrc ) : //! Ref
bDataAtCol( false ),
bDataAtRow( false )
{
-
- lcl_ResizePointVector( mpDimMembers , SC_DP_MAX_FIELDS );
}
ScDPResultData::~ScDPResultData()
@@ -750,7 +738,7 @@ ScDPResultData::~ScDPResultData()
delete[] pMeasRefs;
delete[] pMeasRefOrient;
- lcl_ResizePointVector( mpDimMembers , 0 );
+ std::for_each(maDimMembers.begin(), maDimMembers.end(), ScDeleteObjectByPtr<ResultMembers>());
}
void ScDPResultData::SetMeasureData( long nCount, const ScSubTotalFunc* pFunctions,
@@ -924,8 +912,10 @@ const ScDPSource* ScDPResultData::GetSource() const
ResultMembers* ScDPResultData::GetDimResultMembers(long nDim, ScDPDimension* pDim, ScDPLevel* pLevel) const
{
- if (mpDimMembers[nDim])
- return mpDimMembers[nDim];
+ if (nDim < static_cast<long>(maDimMembers.size()) && maDimMembers[nDim])
+ return maDimMembers[nDim];
+
+ maDimMembers.resize(nDim+1, NULL);
ResultMembers* pResultMembers = new ResultMembers();
// global order is used to initialize aMembers, so it doesn't have to be looked at later
@@ -944,8 +934,8 @@ ResultMembers* ScDPResultData::GetDimResultMembers(long nDim, ScDPDimension* pDi
}
}
- mpDimMembers[nDim] = pResultMembers;
- return mpDimMembers[nDim];
+ maDimMembers[nDim] = pResultMembers;
+ return maDimMembers[nDim];
}
// -----------------------------------------------------------------------