diff options
| author | Eike Rathke <erack@redhat.com> | 2014-03-17 13:50:20 +0100 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2014-03-17 13:57:53 +0100 |
| commit | a45fde7235f95792bf8e6f6979d0040637c5785d (patch) | |
| tree | bbb03a81ac77b73115bc04f2f98098781f89c587 /sc | |
| parent | c80c70c8c306d887ce0b399e9f20b0363e888369 (diff) | |
justify range to prevent negative tab span and memory alloc, rhbz#1057741
I could not reproduce the crash of that bug (probably having more memory
available), but the backtrace had nTabSpan = -2 implicitly casted to
size_t leading to allocation of a huge amount of memory with
vector::reserve(), which ScRange::Justify() exactly prevents.
Change-Id: Idb79e1be62649922ba793cab01e00011479fade9
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/ui/docshell/externalrefmgr.cxx | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sc/source/ui/docshell/externalrefmgr.cxx b/sc/source/ui/docshell/externalrefmgr.cxx index 5b6384832bb5..76b394939bfa 100644 --- a/sc/source/ui/docshell/externalrefmgr.cxx +++ b/sc/source/ui/docshell/externalrefmgr.cxx @@ -2078,6 +2078,7 @@ ScExternalRefCache::TokenArrayRef ScExternalRefManager::getDoubleRefTokensFromSr } ScRange aRange(rRange); + aRange.Justify(); SCTAB nTabSpan = aRange.aEnd.Tab() - aRange.aStart.Tab(); vector<ScExternalRefCache::SingleRangeData> aCacheData; |