commit 1d5630c5deeec5dca724c29ec8c886bfa71a2099
author Tomaž Vajngerl <tomaz.vajngerl@collabora.co.uk> Tue Apr 16 15:21:49 2024 +0900
committer Tomaž Vajngerl <quikee@gmail.com> Tue Apr 16 14:37:43 2024 +0200
tree aae1a04a6e53f008bd52332434626accd1b69fbe
parent 875d99c6e5286b9d56bba32a3abbc37068df61c1

pivot: add checks that prevent reading out of vector bounds

MSO likes to keep formats in the document even when the pivot
table has been changed, so there might be references that contain
indices values that are pointing out of bounds for the current
pivot table result data. To prevent crashing the checks are added
to prevent using an index that is out of vector bounds.

Change-Id: I3824c787659d4e3817a5eb64fe2c8761ef00b610
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166138
Tested-by: Jenkins
Reviewed-by: Tomaž Vajngerl <quikee@gmail.com>

sc/source/core/data/PivotTableFormatOutput.cxx

diff --git a/sc/source/core/data/PivotTableFormatOutput.cxx b/sc/source/core/data/PivotTableFormatOutput.cxx
index fbef219..cdd2ac9 100644
--- a/sc/source/core/data/PivotTableFormatOutput.cxx
+++ b/sc/source/core/data/PivotTableFormatOutput.cxx
@@ -64,6 +64,8 @@ public:
        else
        {
            std::vector<OUString>& rNames = iterator->second;
            if (nIndex >= rNames.size())
                return OUString();
            return rNames[nIndex];
        }
    }
@@ -97,7 +99,7 @@ void initFormatOutputField(size_t nSelectionIndex, std::vector<FormatOutputField

        for (auto const& rSelection : rFormat.aSelections)
        {
            if (rSelection.nField == rOutputField.nDimension)
            if (!rSelection.nIndices.empty() && rSelection.nField == rOutputField.nDimension)
            {
                if (rSelection.nIndices.size() > 1)
                    rOutputField.nIndex = rSelection.nIndices[nSelectionIndex];
@@ -107,8 +109,8 @@ void initFormatOutputField(size_t nSelectionIndex, std::vector<FormatOutputField
                if (rOutputField.nDimension == -2)
                    rOutputField.aName = "DATA";
                else
                    rOutputField.aName
                        = rNameResolver.getNameForIndex(rOutputField.nIndex, rSelection.nField);
                    rOutputField.aName = rNameResolver.getNameForIndex(rOutputField.nIndex,
                                                                       rOutputField.nDimension);

                rOutputField.bSet = true;
            }