disable also ocStyle for Calc's threading

The ocStyle token is only in the RPN tokens, the raw tokens array contains
only ocName, so it's necessary to check also RPN tokens.

Prevents a crash with tdf#91220/1 because of ScInterpreter::ScStyle() causing
a SfxBroadcaster::Broadcast() call.

Change-Id: I7fa04114b698918569014322c721751ab3d8c62f
Reviewed-on: https://gerrit.libreoffice.org/54326
Reviewed-by: Michael Meeks <michael.meeks@collabora.com>
Tested-by: Jenkins <ci@libreoffice.org>

2 files changed, 27 insertions, 1 deletions

diff --git a/formula/source/core/api/FormulaCompiler.cxx b/formula/source/core/api/FormulaCompiler.cxx
index 96c2e166fe00..f5e06e77deba 100644
--- a/formula/source/core/api/FormulaCompiler.cxx
+++ b/formula/source/core/api/FormulaCompiler.cxx
@@ -712,6 +712,7 @@ FormulaCompiler::FormulaCompiler( FormulaTokenArray& rArr )
         bAutoCorrect( false ),
         bCorrected( false ),
         glSubTotal( false ),
+        needsRPNTokenCheck( false ),
         mbJumpCommandReorder(true),
         mbStopOnError(true)
 {
@@ -734,6 +735,7 @@ FormulaCompiler::FormulaCompiler()
         bAutoCorrect( false ),
         bCorrected( false ),
         glSubTotal( false ),
+        needsRPNTokenCheck( false ),
         mbJumpCommandReorder(true),
         mbStopOnError(true)
 {
@@ -1328,7 +1330,14 @@ bool FormulaCompiler::GetToken()
                 glSubTotal = true;
                 break;
             case ocName:
-                return HandleRange();
+                if( HandleRange())
+                {
+                    // Expanding ocName might have introduced tokens such as ocStyle that prevent formula threading,
+                    // but those wouldn't be present in the raw tokens array, so ensure RPN tokens will be checked too.
+                    needsRPNTokenCheck = true;
+                    return true;
+                }
+                return false;
             case ocColRowName:
                 return HandleColRowName();
             case ocDBArea:
@@ -1980,6 +1989,7 @@ bool FormulaCompiler::CompileTokenArray()
 {
     glSubTotal = false;
     bCorrected = false;
+    needsRPNTokenCheck = false;
     if (pArr->GetCodeError() == FormulaError::NONE || !mbStopOnError)
     {
         if ( bAutoCorrect )
@@ -2013,7 +2023,11 @@ bool FormulaCompiler::CompileTokenArray()
         while( pStack )
             PopTokenArray();
         if( pc )
+        {
             pArr->CreateNewRPNArrayFromData( pData, pc );
+            if( needsRPNTokenCheck )
+                pArr->CheckAllRPNTokens();
+        }
 
         // once an error, always an error
         if( pArr->GetCodeError() == FormulaError::NONE && nErrorBeforePop != FormulaError::NONE )
diff --git a/formula/source/core/api/token.cxx b/formula/source/core/api/token.cxx
index 649a8d36c443..42b19f8543c0 100644
--- a/formula/source/core/api/token.cxx
+++ b/formula/source/core/api/token.cxx
@@ -674,6 +674,18 @@ void FormulaTokenArray::CheckToken( const FormulaToken& /*r*/ )
     // Do nothing.
 }
 
+void FormulaTokenArray::CheckAllRPNTokens()
+{
+    if( nRPN )
+    {
+        FormulaToken** p = pRPN;
+        for( sal_uInt16 i = 0; i < nRPN; i++ )
+        {
+            CheckToken( *p[ i ] );
+        }
+    }
+}
+
 FormulaToken* FormulaTokenArray::AddToken( const FormulaToken& r )
 {
     return Add( r.Clone() );