diff options
| author | Luboš Luňák <l.lunak@collabora.com> | 2020-05-07 13:43:05 +0200 |
|---|---|---|
| committer | Luboš Luňák <l.lunak@collabora.com> | 2020-05-07 15:34:53 +0200 |
| commit | 58c87f8261abf4f1528a43dc501e956cb9c1d2f2 (patch) | |
| tree | 5495cf50b171495f1b4909dcd2a59505290a8240 /sc/source/core/data | |
| parent | 142a2d3d51b8d1cacea6593a856ba7a7a1d477be (diff) | |
sanitize properly Calc search bounds (tdf#132097)
The row/col handling seems really weird to me here in some places
(like starting actually at startcol+1 in some cases). But at least
properly limit the values to prevent out-of-bounds accesses.
This also reverts 2670e980c7dbadbdc20ff23d57ad892951edc254.
Change-Id: I5eb94f3841f3defa763046d5d5bec805abd97c62
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93634
Tested-by: Jenkins
Reviewed-by: Luboš Luňák <l.lunak@collabora.com>
Diffstat (limited to 'sc/source/core/data')
| -rw-r--r-- | sc/source/core/data/table6.cxx | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/sc/source/core/data/table6.cxx b/sc/source/core/data/table6.cxx index a66822fcb9da..0605fa5683a4 100644 --- a/sc/source/core/data/table6.cxx +++ b/sc/source/core/data/table6.cxx @@ -339,17 +339,17 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem, SCCOL& rCol, SCROW& rRow, bool bSkipFiltered = !rSearchItem.IsSearchFiltered(); bool bSearchNotes = (rSearchItem.GetCellType() == SvxSearchCellType::NOTE); // We need to cache sc::ColumnBlockConstPosition per each column. - std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 2 ); - for( SCCOL i = 0; i <= nLastCol+1; ++i ) + std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 1 ); + for( SCCOL i = 0; i <= nLastCol; ++i ) aCol[ i ].InitBlockPosition( blockPos[ i ] ); if (!bAll && rSearchItem.GetBackward()) { SCROW nLastNonFilteredRow = pDocument->MaxRow() + 1; - nCol = std::min(nCol, static_cast<SCCOL>(nLastCol + 1)); - nRow = std::min(nRow, static_cast<SCROW>(nLastRow + 1)); if (rSearchItem.GetRowDirection()) { nCol--; + nCol = std::min(nCol, nLastCol); + nRow = std::min(nRow, nLastRow); while (!bFound && (nRow >= 0)) { if (bSkipFiltered) @@ -388,6 +388,8 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem, SCCOL& rCol, SCROW& rRow, else { nRow--; + nCol = std::min(nCol, nLastCol); + nRow = std::min(nRow, nLastRow); while (!bFound && (nCol >= 0)) { while (!bFound && (nRow >= 0)) |