sc/source/core/data/table6.cxx | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
New commits:
commit 58c87f8261abf4f1528a43dc501e956cb9c1d2f2
Author: Luboš Luňák <l.lu...@collabora.com>
AuthorDate: Thu May 7 13:43:05 2020 +0200
Commit: Luboš Luňák <l.lu...@collabora.com>
CommitDate: Thu May 7 15:34:53 2020 +0200
sanitize properly Calc search bounds (tdf#132097)
The row/col handling seems really weird to me here in some places
(like starting actually at startcol+1 in some cases). But at least
properly limit the values to prevent out-of-bounds accesses.
This also reverts 2670e980c7dbadbdc20ff23d57ad892951edc254.
Change-Id: I5eb94f3841f3defa763046d5d5bec805abd97c62
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/93634
Tested-by: Jenkins
Reviewed-by: Luboš Luňák <l.lu...@collabora.com>
diff --git a/sc/source/core/data/table6.cxx b/sc/source/core/data/table6.cxx
index a66822fcb9da..0605fa5683a4 100644
--- a/sc/source/core/data/table6.cxx
+++ b/sc/source/core/data/table6.cxx
@@ -339,17 +339,17 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem,
SCCOL& rCol, SCROW& rRow,
bool bSkipFiltered = !rSearchItem.IsSearchFiltered();
bool bSearchNotes = (rSearchItem.GetCellType() == SvxSearchCellType::NOTE);
// We need to cache sc::ColumnBlockConstPosition per each column.
- std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 2 );
- for( SCCOL i = 0; i <= nLastCol+1; ++i )
+ std::vector< sc::ColumnBlockConstPosition > blockPos( nLastCol + 1 );
+ for( SCCOL i = 0; i <= nLastCol; ++i )
aCol[ i ].InitBlockPosition( blockPos[ i ] );
if (!bAll && rSearchItem.GetBackward())
{
SCROW nLastNonFilteredRow = pDocument->MaxRow() + 1;
- nCol = std::min(nCol, static_cast<SCCOL>(nLastCol + 1));
- nRow = std::min(nRow, static_cast<SCROW>(nLastRow + 1));
if (rSearchItem.GetRowDirection())
{
nCol--;
+ nCol = std::min(nCol, nLastCol);
+ nRow = std::min(nRow, nLastRow);
while (!bFound && (nRow >= 0))
{
if (bSkipFiltered)
@@ -388,6 +388,8 @@ bool ScTable::Search(const SvxSearchItem& rSearchItem,
SCCOL& rCol, SCROW& rRow,
else
{
nRow--;
+ nCol = std::min(nCol, nLastCol);
+ nRow = std::min(nRow, nLastRow);
while (!bFound && (nCol >= 0))
{
while (!bFound && (nRow >= 0))
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
