summaryrefslogtreecommitdiff
path: root/sc
diff options
context:
space:
mode:
authorEike Rathke <erack@redhat.com>2014-03-17 13:50:20 +0100
committerMarkus Mohrhard <markus.mohrhard@googlemail.com>2014-03-17 13:37:48 +0000
commitcc605367d4f135adc815582900794f0cfdb88aa7 (patch)
treeed8d8875182efa7672a28f6a5ce798296dc4bc7a /sc
parent2b54ede7e2c3b4f2c0baeb53bb798f507ba15719 (diff)
justify range to prevent negative tab span and memory alloc, rhbz#1057741
I could not reproduce the crash of that bug (probably having more memory available), but the backtrace had nTabSpan = -2 implicitly casted to size_t leading to allocation of a huge amount of memory with vector::reserve(), which ScRange::Justify() exactly prevents. Change-Id: Idb79e1be62649922ba793cab01e00011479fade9 (cherry picked from commit a45fde7235f95792bf8e6f6979d0040637c5785d) Reviewed-on: https://gerrit.libreoffice.org/8625 Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com> Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Diffstat (limited to 'sc')
-rw-r--r--sc/source/ui/docshell/externalrefmgr.cxx1
1 files changed, 1 insertions, 0 deletions
diff --git a/sc/source/ui/docshell/externalrefmgr.cxx b/sc/source/ui/docshell/externalrefmgr.cxx
index 8b5b40d9eb25..3e142eb51f34 100644
--- a/sc/source/ui/docshell/externalrefmgr.cxx
+++ b/sc/source/ui/docshell/externalrefmgr.cxx
@@ -1927,6 +1927,7 @@ ScExternalRefCache::TokenArrayRef ScExternalRefManager::getDoubleRefTokensFromSr
}
ScRange aRange(rRange);
+ aRange.Justify();
SCTAB nTabSpan = aRange.aEnd.Tab() - aRange.aStart.Tab();
vector<ScExternalRefCache::SingleRangeData> aCacheData;