sc/source/core/data/PivotTableFormatOutput.cxx | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
New commits:
commit 1d5630c5deeec5dca724c29ec8c886bfa71a2099
Author: Tomaž Vajngerl <tomaz.vajng...@collabora.co.uk>
AuthorDate: Tue Apr 16 15:21:49 2024 +0900
Commit: Tomaž Vajngerl <qui...@gmail.com>
CommitDate: Tue Apr 16 14:37:43 2024 +0200
pivot: add checks that prevent reading out of vector bounds
MSO likes to keep formats in the document even when the pivot
table has been changed, so there might be references that contain
indices values that are pointing out of bounds for the current
pivot table result data. To prevent crashing the checks are added
to prevent using an index that is out of vector bounds.
Change-Id: I3824c787659d4e3817a5eb64fe2c8761ef00b610
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166138
Tested-by: Jenkins
Reviewed-by: Tomaž Vajngerl <qui...@gmail.com>
diff --git a/sc/source/core/data/PivotTableFormatOutput.cxx
b/sc/source/core/data/PivotTableFormatOutput.cxx
index fbef219b513b..cdd2ac90914f 100644
--- a/sc/source/core/data/PivotTableFormatOutput.cxx
+++ b/sc/source/core/data/PivotTableFormatOutput.cxx
@@ -64,6 +64,8 @@ public:
else
{
std::vector<OUString>& rNames = iterator->second;
+ if (nIndex >= rNames.size())
+ return OUString();
return rNames[nIndex];
}
}
@@ -97,7 +99,7 @@ void initFormatOutputField(size_t nSelectionIndex,
std::vector<FormatOutputField
for (auto const& rSelection : rFormat.aSelections)
{
- if (rSelection.nField == rOutputField.nDimension)
+ if (!rSelection.nIndices.empty() && rSelection.nField ==
rOutputField.nDimension)
{
if (rSelection.nIndices.size() > 1)
rOutputField.nIndex = rSelection.nIndices[nSelectionIndex];
@@ -107,8 +109,8 @@ void initFormatOutputField(size_t nSelectionIndex,
std::vector<FormatOutputField
if (rOutputField.nDimension == -2)
rOutputField.aName = "DATA";
else
- rOutputField.aName
- = rNameResolver.getNameForIndex(rOutputField.nIndex,
rSelection.nField);
+ rOutputField.aName =
rNameResolver.getNameForIndex(rOutputField.nIndex,
+
rOutputField.nDimension);
rOutputField.bSet = true;
}
