sc/source/core/tool/interpr1.cxx |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

New commits:
commit 48145dddb6265920a20ac70683d5d2f73f7b2b4b
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue Feb 7 10:30:33 2023 +0000
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Wed Jun 21 12:30:27 2023 +0200

    crashtesting: crash in ScInterpreter::ScCountIfs
    
    seen on importing forum-mso-en4-253817.xls and others
    
    Error: attempt to advance a dereferenceable (start-of-sequence) iterator
    which falls outside its valid range.
    
    presumably since:
    
    commit 7674399aac661eb503d7badc53b9a4d68bd9839d
    Date:   Fri May 27 19:51:40 2022 +0200
    
        try to range-reduce even COUNTIFS if not matching empty cells
    
    bodge this to fill in 0 for missing ranges
    
    Change-Id: If77d8ab887859f11b240975bb837a27785f500a1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146604
    Tested-by: Jenkins
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit e7897ce47e415e46eb36687f911a9a4b09ca6b8a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153376
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
index 7283002f328d..1fbe376edff1 100644
--- a/sc/source/core/tool/interpr1.cxx
+++ b/sc/source/core/tool/interpr1.cxx
@@ -6134,8 +6134,14 @@ void ScInterpreter::IterateParametersIfs( 
double(*ResultFunc)( const sc::ParamIf
                     {
                         newConditions.insert( newConditions.end(), 
nStartRowDiff, 0 );
                         SCCOL oldCol = col - ( nCol1 + nStartColDiff );
-                        auto it = vConditions.begin() + oldCol * 
nDimensionRows;
-                        newConditions.insert( newConditions.end(), it, it + 
nDimensionRows );
+                        size_t nIndex = oldCol * nDimensionRows;
+                        if (nIndex < vConditions.size())
+                        {
+                            auto it = vConditions.begin() + nIndex;
+                            newConditions.insert( newConditions.end(), it, it 
+ nDimensionRows );
+                        }
+                        else
+                            newConditions.insert( newConditions.end(), 
nDimensionRows, 0 );
                         newConditions.insert( newConditions.end(), 
-nEndRowDiff, 0 );
                     }
                     for(; col <= nCol2; ++col)

Reply via email to