sc/source/core/data/dpoutput.cxx | 112 +++++++++++++++++++++++----------------
1 file changed, 68 insertions(+), 44 deletions(-)
New commits:
commit cbba64225a2abfdd8b2437e8a06925b15fb15d26
Author: Eike Rathke <er...@redhat.com>
Date: Fri Feb 17 14:10:37 2017 +0100
Resolves: tdf#105858 check SC_DPOUT_MAXLEVELS to prevent crash
Backported.
This is a combination of 2 commits.
Resolves: tdf#105858 check nDataCount<SC_DPOUT_MAXLEVELS to prevent crash
(cherry picked from commit 9bdf971b0202c6d55d88e61861b251459de9586b)
more counts<SC_DPOUT_MAXLEVELS to check, tdf#105858 related
Also for row, column and page field arrays.
(cherry picked from commit 7fbdd8b7d3741d55b229977f9e6d6213af5fa542)
1dccdf139af778a2c0dc550be0b573c984256a2d
Change-Id: If9084543a0a191d08da37b5b8a187bce46440871
Reviewed-on: https://gerrit.libreoffice.org/34370
Tested-by: Jenkins <c...@libreoffice.org>
Reviewed-by: Markus Mohrhard <markus.mohrh...@googlemail.com>
diff --git a/sc/source/core/data/dpoutput.cxx b/sc/source/core/data/dpoutput.cxx
index d62739e..09b005c 100644
--- a/sc/source/core/data/dpoutput.cxx
+++ b/sc/source/core/data/dpoutput.cxx
@@ -343,9 +343,10 @@ void lcl_FillNumberFormats( sal_uInt32*& rFormats, long&
rCount,
OUString aDataNames[SC_DPOUT_MAXLEVELS];
sal_uInt32 nDataFormats[SC_DPOUT_MAXLEVELS];
- long nDataCount = 0;
- long nDimCount = xDims->getCount();
- for (long nDim=0; nDim<nDimCount; nDim++)
+ size_t nDataCount = 0;
+ sal_Int32 nDimCount = xDims->getCount();
+ sal_Int32 nDim = 0;
+ for ( ; nDim < nDimCount && nDataCount < SC_DPOUT_MAXLEVELS; nDim++)
{
uno::Reference<uno::XInterface> xDim =
ScUnoHelpFunctions::AnyToInterface( xDims->getByIndex(nDim) );
@@ -368,6 +369,8 @@ void lcl_FillNumberFormats( sal_uInt32*& rFormats, long&
rCount,
}
}
}
+ SAL_WARN_IF( nDim < nDimCount && nDataCount == SC_DPOUT_MAXLEVELS,
"sc.core",
+ "lcl_FillNumberFormats - may have lost an output level due to
SC_DPOUT_MAXLEVELS=" << SC_DPOUT_MAXLEVELS);
if (!nDataCount)
return;
@@ -393,7 +396,7 @@ void lcl_FillNumberFormats( sal_uInt32*& rFormats, long&
rCount,
aName = pArray[nPos].Name;
sal_uInt32 nFormat = 0;
- for (long i=0; i<nDataCount; i++)
+ for (size_t i=0; i<nDataCount; i++)
if (aName == aDataNames[i]) //TODO: search more
efficiently?
{
nFormat = nDataFormats[i];
@@ -605,50 +608,71 @@ ScDPOutput::ScDPOutput( ScDocument* pD, const
uno::Reference<sheet::XDimensionsS
switch ( eDimOrient )
{
case
sheet::DataPilotFieldOrientation_COLUMN:
- pColFields[nColFieldCount].nDim =
nDim;
- pColFields[nColFieldCount].nHier =
nHierarchy;
- pColFields[nColFieldCount].nLevel =
nLev;
- pColFields[nColFieldCount].nDimPos =
nDimPos;
- pColFields[nColFieldCount].aResult =
xLevRes->getResults();
- pColFields[nColFieldCount].mnSrcNumFmt
= nNumFmt;
- pColFields[nColFieldCount].maName =
aName;
- pColFields[nColFieldCount].maCaption=
aCaption;
-
pColFields[nColFieldCount].mbHasHiddenMember = bHasHiddenMember;
-
pColFields[nColFieldCount].mbDataLayout = bIsDataLayout;
- if
(!lcl_MemberEmpty(pColFields[nColFieldCount].aResult))
- ++nColFieldCount;
- break;
+ if (nColFieldCount <
SC_DPOUT_MAXLEVELS)
+ {
+ pColFields[nColFieldCount].nDim
= nDim;
+ pColFields[nColFieldCount].nHier
= nHierarchy;
+ pColFields[nColFieldCount].nLevel
= nLev;
+ pColFields[nColFieldCount].nDimPos
= nDimPos;
+ pColFields[nColFieldCount].aResult
= xLevRes->getResults();
+
pColFields[nColFieldCount].mnSrcNumFmt = nNumFmt;
+ pColFields[nColFieldCount].maName
= aName;
+
pColFields[nColFieldCount].maCaption= aCaption;
+
pColFields[nColFieldCount].mbHasHiddenMember = bHasHiddenMember;
+
pColFields[nColFieldCount].mbDataLayout = bIsDataLayout;
+ if
(!lcl_MemberEmpty(pColFields[nColFieldCount].aResult))
+ ++nColFieldCount;
+ }
+ else
+ {
+ SAL_WARN("sc.core","ScDPOutput -
nColFieldCount already at SC_DPOUT_MAXLEVELS=" << SC_DPOUT_MAXLEVELS);
+ }
+ break;
case sheet::DataPilotFieldOrientation_ROW:
- pRowFields[nRowFieldCount].nDim =
nDim;
- pRowFields[nRowFieldCount].nHier =
nHierarchy;
- pRowFields[nRowFieldCount].nLevel =
nLev;
- pRowFields[nRowFieldCount].nDimPos =
nDimPos;
- pRowFields[nRowFieldCount].aResult =
xLevRes->getResults();
- pRowFields[nRowFieldCount].mnSrcNumFmt
= nNumFmt;
- pRowFields[nRowFieldCount].maName =
aName;
- pRowFields[nRowFieldCount].maCaption=
aCaption;
-
pRowFields[nRowFieldCount].mbHasHiddenMember = bHasHiddenMember;
-
pRowFields[nRowFieldCount].mbDataLayout = bIsDataLayout;
- if
(!lcl_MemberEmpty(pRowFields[nRowFieldCount].aResult))
+ if (nRowFieldCount <
SC_DPOUT_MAXLEVELS)
{
- ++nRowFieldCount;
- bRowFieldHasMember = true;
+ pRowFields[nRowFieldCount].nDim
= nDim;
+ pRowFields[nRowFieldCount].nHier
= nHierarchy;
+ pRowFields[nRowFieldCount].nLevel
= nLev;
+ pRowFields[nRowFieldCount].nDimPos
= nDimPos;
+ pRowFields[nRowFieldCount].aResult
= xLevRes->getResults();
+
pRowFields[nRowFieldCount].mnSrcNumFmt = nNumFmt;
+ pRowFields[nRowFieldCount].maName
= aName;
+
pRowFields[nRowFieldCount].maCaption= aCaption;
+
pRowFields[nRowFieldCount].mbHasHiddenMember = bHasHiddenMember;
+
pRowFields[nRowFieldCount].mbDataLayout = bIsDataLayout;
+ if
(!lcl_MemberEmpty(pRowFields[nRowFieldCount].aResult))
+ {
+ ++nRowFieldCount;
+ bRowFieldHasMember = true;
+ }
}
- break;
+ else
+ {
+ SAL_WARN("sc.core","ScDPOutput -
nRowFieldCount already at SC_DPOUT_MAXLEVELS=" << SC_DPOUT_MAXLEVELS);
+ }
+ break;
case sheet::DataPilotFieldOrientation_PAGE:
- pPageFields[nPageFieldCount].nDim =
nDim;
- pPageFields[nPageFieldCount].nHier =
nHierarchy;
- pPageFields[nPageFieldCount].nLevel =
nLev;
- pPageFields[nPageFieldCount].nDimPos =
nDimPos;
- pPageFields[nPageFieldCount].aResult =
getVisiblePageMembersAsResults(xLevel);
-
pPageFields[nPageFieldCount].mnSrcNumFmt = nNumFmt;
- pPageFields[nPageFieldCount].maName =
aName;
-
pPageFields[nPageFieldCount].maCaption= aCaption;
-
pPageFields[nPageFieldCount].mbHasHiddenMember = bHasHiddenMember;
- pPageFields[nPageFieldCount].mbPageDim
= true;
- // no check on results for page fields
- ++nPageFieldCount;
- break;
+ if (nPageFieldCount <
SC_DPOUT_MAXLEVELS)
+ {
+ pPageFields[nPageFieldCount].nDim
= nDim;
+ pPageFields[nPageFieldCount].nHier
= nHierarchy;
+
pPageFields[nPageFieldCount].nLevel = nLev;
+
pPageFields[nPageFieldCount].nDimPos = nDimPos;
+
pPageFields[nPageFieldCount].aResult = getVisiblePageMembersAsResults(xLevel);
+
pPageFields[nPageFieldCount].mnSrcNumFmt = nNumFmt;
+
pPageFields[nPageFieldCount].maName = aName;
+
pPageFields[nPageFieldCount].maCaption= aCaption;
+
pPageFields[nPageFieldCount].mbHasHiddenMember = bHasHiddenMember;
+
pPageFields[nPageFieldCount].mbPageDim = true;
+ // no check on results for page
fields
+ ++nPageFieldCount;
+ }
+ else
+ {
+ SAL_WARN("sc.core","ScDPOutput -
nPageFieldCount already at SC_DPOUT_MAXLEVELS=" << SC_DPOUT_MAXLEVELS);
+ }
+ break;
default:
{
// added to avoid warnings
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
