sc/source/ui/docshell/externalrefmgr.cxx | 1 +
1 file changed, 1 insertion(+)
New commits:
commit dde6049fe4abc03b8f98ffca1a940d6f2f446095
Author: Eike Rathke <er...@redhat.com>
Date: Mon Mar 17 13:50:20 2014 +0100
justify range to prevent negative tab span and memory alloc, rhbz#1057741
I could not reproduce the crash of that bug (probably having more memory
available), but the backtrace had nTabSpan = -2 implicitly casted to
size_t leading to allocation of a huge amount of memory with
vector::reserve(), which ScRange::Justify() exactly prevents.
Change-Id: Idb79e1be62649922ba793cab01e00011479fade9
(cherry picked from commit a45fde7235f95792bf8e6f6979d0040637c5785d)
Reviewed-on: https://gerrit.libreoffice.org/8624
Tested-by: Markus Mohrhard <markus.mohrh...@googlemail.com>
Reviewed-by: Markus Mohrhard <markus.mohrh...@googlemail.com>
diff --git a/sc/source/ui/docshell/externalrefmgr.cxx
b/sc/source/ui/docshell/externalrefmgr.cxx
index b2a19d9..3c051ac 100644
--- a/sc/source/ui/docshell/externalrefmgr.cxx
+++ b/sc/source/ui/docshell/externalrefmgr.cxx
@@ -2078,6 +2078,7 @@ ScExternalRefCache::TokenArrayRef
ScExternalRefManager::getDoubleRefTokensFromSr
}
ScRange aRange(rRange);
+ aRange.Justify();
SCTAB nTabSpan = aRange.aEnd.Tab() - aRange.aStart.Tab();
vector<ScExternalRefCache::SingleRangeData> aCacheData;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
