fixed various crashes due to newly introduced

ScRangeName::maIndexToData

* The newly introduced ScRangeName::maIndexToData needs to take into
  account that boost::ptr_set clones and deletes elements, hence each
  collection needs its own maIndexToData setup in copy-ctor.
* Also fixed ScRangeName::erase() where a wrong index element was set to NULL.

Signed-off-by: Eike Rathke <erack@erack.de>

1 files changed, 20 insertions, 3 deletions

diff --git a/sc/source/core/tool/rangenam.cxx b/sc/source/core/tool/rangenam.cxx
index 599590a93..35c00dc44 100644
--- a/sc/source/core/tool/rangenam.cxx
+++ b/sc/source/core/tool/rangenam.cxx
@@ -735,7 +735,23 @@ void ScRangeName::copyLocalNames(const TabNameMap& rNames, TabNameCopyMap& rCopy
 ScRangeName::ScRangeName() {}
 
 ScRangeName::ScRangeName(const ScRangeName& r) :
-    maData(r.maData), maIndexToData(r.maIndexToData) {}
+    maData(r.maData)
+{
+    // boost::ptr_set clones and deletes, so each collection needs its own
+    // index to data.
+    maIndexToData.resize( r.maIndexToData.size(), NULL);
+    DataType::const_iterator itr = maData.begin(), itrEnd = maData.end();
+    for (; itr != itrEnd; ++itr)
+    {
+        size_t nPos = itr->GetIndex() - 1;
+        if (nPos >= maIndexToData.size())
+        {
+            OSL_FAIL( "ScRangeName copy-ctor: maIndexToData size doesn't fit");
+            maIndexToData.resize(nPos+1, NULL);
+        }
+        maIndexToData[nPos] = const_cast<ScRangeData*>(&(*itr));
+    }
+}
 
 const ScRangeData* ScRangeName::findByRange(const ScRange& rRange) const
 {
@@ -885,8 +901,9 @@ void ScRangeName::erase(const iterator& itr)
 {
     sal_uInt16 nIndex = itr->GetIndex();
     maData.erase(itr);
-    if (nIndex < maIndexToData.size())
-        maIndexToData[nIndex] = NULL;
+    OSL_ENSURE( 0 < nIndex && nIndex <= maIndexToData.size(), "ScRangeName::erase: bad index");
+    if (0 < nIndex && nIndex <= maIndexToData.size())
+        maIndexToData[nIndex-1] = NULL;
 }
 
 void ScRangeName::clear()