diff options
| author | Kohei Yoshida <kohei.yoshida@gmail.com> | 2012-12-14 22:34:38 -0500 |
|---|---|---|
| committer | Markus Mohrhard <markus.mohrhard@googlemail.com> | 2012-12-15 08:00:41 +0000 |
| commit | 82b03180e66559c53911c404af455ca0d3505948 (patch) | |
| tree | 20ab5d199f36e99c4d15d0f4fe17fbd3c3be7e56 /sc | |
| parent | 60da9c5fee9f5ff9d6789478ea7dd709846c305c (diff) | |
Do extra check on source range to make sure no funny things happen.
Like a crash in the pivot layout dialog... :-/
Change-Id: I9a330ee3f39ebacb7299d24868bb13ee2a9c3ec5
Reviewed-on: https://gerrit.libreoffice.org/1345
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Diffstat (limited to 'sc')
| -rw-r--r-- | sc/source/core/data/dpcache.cxx | 5 | ||||
| -rw-r--r-- | sc/source/core/data/dpshttab.cxx | 8 |
2 files changed, 13 insertions, 0 deletions
diff --git a/sc/source/core/data/dpcache.cxx b/sc/source/core/data/dpcache.cxx index 611328256820..7fdf098d7c63 100644 --- a/sc/source/core/data/dpcache.cxx +++ b/sc/source/core/data/dpcache.cxx @@ -382,6 +382,11 @@ bool ScDPCache::InitFromDoc(ScDocument* pDoc, const ScRange& rRange) SCROW nStartRow = rRange.aStart.Row(); // start of data SCROW nEndRow = rRange.aEnd.Row(); + + // Sanity check + if (!ValidRow(nStartRow) || !ValidRow(nEndRow) || nEndRow-nStartRow <= 0) + return false; + sal_uInt16 nStartCol = rRange.aStart.Col(); sal_uInt16 nEndCol = rRange.aEnd.Col(); sal_uInt16 nDocTab = rRange.aStart.Tab(); diff --git a/sc/source/core/data/dpshttab.cxx b/sc/source/core/data/dpshttab.cxx index 8ee3d4e3d61c..d2d8fafcdca7 100644 --- a/sc/source/core/data/dpshttab.cxx +++ b/sc/source/core/data/dpshttab.cxx @@ -335,6 +335,14 @@ sal_uLong ScSheetSourceDesc::CheckSourceRange() const if (!mpDoc) return STR_ERR_DATAPILOTSOURCE; + // Make sure the range is valid and sane. + const ScRange& rSrcRange = GetSourceRange(); + if (!rSrcRange.IsValid()) + return STR_ERR_DATAPILOTSOURCE; + + if (rSrcRange.aStart.Col() > rSrcRange.aEnd.Col() || rSrcRange.aStart.Row() > rSrcRange.aEnd.Row()) + return STR_ERR_DATAPILOTSOURCE; + return 0; } |