crashtesting: crash on converting ooo93489-1.ods to pdf

with --headless --convert-to pdf ooo93489-1.ods

probable regression from...

commit d4daad185e9583bedbb5a4eef1fd53e1f22e219b
Author: Jan Holesovsky <kendy@collabora.com>
Date:   Mon Nov 30 10:28:43 2015 +0100

    sc interpreter: Move the code that can create a ScFullMatrix.

In that original code I see there was a check for "Data array is shorter than
the row size of the reference. Truncate it to the data" which doesn't exist
anymore. If I reintroduce that check here the crash is avoided.

Change-Id: I7c7a5979d9c14c133b05e89ce3794e6b739ca61c
Reviewed-on: https://gerrit.libreoffice.org/20794
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>
(cherry picked from commit ddeca090ba612cdd5a2d55785fb1c4b66b6bc0a5)
Reviewed-on: https://gerrit.libreoffice.org/20800

1 files changed, 13 insertions, 3 deletions

diff --git a/sc/source/core/tool/scmatrix.cxx b/sc/source/core/tool/scmatrix.cxx
index 42d25ba7b001..d3816b5e6626 100644
--- a/sc/source/core/tool/scmatrix.cxx
+++ b/sc/source/core/tool/scmatrix.cxx
@@ -2994,6 +2994,16 @@ void ScVectorRefMatrix::ensureFullMatrix()
     size_t nColSize = rArrays.size();
     mpFullMatrix.reset(new ScFullMatrix(nColSize, mnRowSize));
 
+    size_t nRowSize = mnRowSize;
+    size_t nRowEnd = mnRowStart + mnRowSize;
+    size_t nDataRowEnd = mpToken->GetArrayLength();
+    if (nRowEnd > nDataRowEnd)
+    {
+        // Data array is shorter than the row size of the reference. Truncate
+        // it to the data.
+        nRowSize -= nRowEnd - nDataRowEnd;
+    }
+
     for (size_t nCol = 0; nCol < nColSize; ++nCol)
     {
         const formula::VectorRefArray& rArray = rArrays[nCol];
@@ -3006,14 +3016,14 @@ void ScVectorRefMatrix::ensureFullMatrix()
                 pNums += mnRowStart;
                 rtl_uString** pStrs = rArray.mpStringArray;
                 pStrs += mnRowStart;
-                fillMatrix(*mpFullMatrix, nCol, pNums, pStrs, mnRowSize);
+                fillMatrix(*mpFullMatrix, nCol, pNums, pStrs, nRowSize);
             }
             else
             {
                 // String cells only.
                 rtl_uString** pStrs = rArray.mpStringArray;
                 pStrs += mnRowStart;
-                fillMatrix(*mpFullMatrix, nCol, pStrs, mnRowSize);
+                fillMatrix(*mpFullMatrix, nCol, pStrs, nRowSize);
             }
         }
         else if (rArray.mpNumericArray)
@@ -3021,7 +3031,7 @@ void ScVectorRefMatrix::ensureFullMatrix()
             // Numeric cells only.
             const double* pNums = rArray.mpNumericArray;
             pNums += mnRowStart;
-            fillMatrix(*mpFullMatrix, nCol, pNums, mnRowSize);
+            fillMatrix(*mpFullMatrix, nCol, pNums, nRowSize);
         }
     }
 }