crash when modifing a named range

Signed-off-by: Markus Mohrhard <markus.mohrhard@googlemail.com>

10 files changed, 28 insertions, 25 deletions

diff --git a/sc/inc/rangenam.hxx b/sc/inc/rangenam.hxx
index 86d33c6ad..fdff2784d 100644
--- a/sc/inc/rangenam.hxx
+++ b/sc/inc/rangenam.hxx
@@ -217,7 +217,14 @@ public:
     SC_DLLPUBLIC iterator end();
     SC_DLLPUBLIC size_t size() const;
     bool empty() const;
+
+    /** Insert object into set if not a duplicate.
+        @ATTENTION: The underlying ::boost::ptr_set_adapter::insert(p) takes
+        ownership of p and if it can't insert it deletes the object! So, if
+        this insert here returns false the object where p pointed to is gone!
+     */
     SC_DLLPUBLIC bool insert(ScRangeData* p);
+
     void erase(const ScRangeData& r);
 
     /**
diff --git a/sc/source/core/data/documen2.cxx b/sc/source/core/data/documen2.cxx
index 80b0c12e4..97292cadd 100644
--- a/sc/source/core/data/documen2.cxx
+++ b/sc/source/core/data/documen2.cxx
@@ -1015,7 +1015,7 @@ sal_uLong ScDocument::TransferTab( ScDocument* pSrcDoc, SCTAB nSrcPos,
                             if (!pRangeName->insert(pData))
                             {
                                 OSL_FAIL("can't insert name");     // shouldn't happen
-                                delete pData;
+                                pData = NULL;
                             }
                             else
                             {
diff --git a/sc/source/core/data/document.cxx b/sc/source/core/data/document.cxx
index 3e86a758c..6668b748c 100644
--- a/sc/source/core/data/document.cxx
+++ b/sc/source/core/data/document.cxx
@@ -1719,9 +1719,7 @@ void ScDocument::TransposeClip( ScDocument* pTransClip, sal_uInt16 nFlags, sal_B
         {
             sal_uInt16 nIndex = itr->GetIndex();
             ScRangeData* pData = new ScRangeData(*itr);
-            if (!pTransClip->pRangeName->insert(pData))
-                delete pData;
-            else
+            if (pTransClip->pRangeName->insert(pData))
                 pData->SetIndex(nIndex);
         }
     }
@@ -1784,9 +1782,7 @@ void copyUsedNamesToClip(ScRangeName* pClipRangeName, ScRangeName* pRangeName, c
             continue;
 
         ScRangeData* pData = new ScRangeData(*itr);
-        if (!pClipRangeName->insert(pData))
-            delete pData;
-        else
+        if (pClipRangeName->insert(pData))
             pData->SetIndex(nIndex);
     }
 }
@@ -1894,7 +1890,7 @@ void ScDocument::CopyRangeNamesFromClip(ScDocument* pClipDoc, ScClipRangeNameDat
             }
             else
             {   // must be an overflow
-                delete pData;
+                pData = NULL;
                 aClipRangeNames.insert(itr->GetIndex(), 0);
                 aClipRangeNames.mbReplace = true;
             }
diff --git a/sc/source/filter/excel/xiname.cxx b/sc/source/filter/excel/xiname.cxx
index 8a80f5217..938fb69d6 100644
--- a/sc/source/filter/excel/xiname.cxx
+++ b/sc/source/filter/excel/xiname.cxx
@@ -216,14 +216,20 @@ XclImpName::XclImpName( XclImpStream& rStrm, sal_uInt16 nXclNameIdx ) :
         pData->GuessPosition();             // calculate base position for relative refs
         pData->SetIndex( nXclNameIdx );     // used as unique identifier in formulas
         if (nXclTab == EXC_NAME_GLOBAL)
-            GetDoc().GetRangeName()->insert(pData);
+        {
+            if (!GetDoc().GetRangeName()->insert(pData))
+                pData = NULL;
+        }
         else
         {
             ScRangeName* pLocalNames = GetDoc().GetRangeName(mnScTab);
             if (pLocalNames)
-                pLocalNames->insert(pData);
+            {
+                if (!pLocalNames->insert(pData))
+                    pData = NULL;
+            }
 
-            if (GetBiff() == EXC_BIFF8)
+            if (GetBiff() == EXC_BIFF8 && pData)
             {
                 ScRange aRange;
                 // discard deleted ranges ( for the moment at least )
@@ -233,7 +239,8 @@ XclImpName::XclImpName( XclImpStream& rStrm, sal_uInt16 nXclNameIdx ) :
                 }
             }
         }
-        mpScData = pData;                   // cache for later use
+        if (pData)
+            mpScData = pData;               // cache for later use
     }
 }
 
diff --git a/sc/source/filter/html/htmlimp.cxx b/sc/source/filter/html/htmlimp.cxx
index b8a5575a9..7ebe5e111 100644
--- a/sc/source/filter/html/htmlimp.cxx
+++ b/sc/source/filter/html/htmlimp.cxx
@@ -132,8 +132,7 @@ void ScHTMLImport::InsertRangeName( ScDocument* pDoc, const String& rName, const
     ScTokenArray aTokArray;
     aTokArray.AddDoubleReference( aRefData );
     ScRangeData* pRangeData = new ScRangeData( pDoc, rName, aTokArray );
-    if( !pDoc->GetRangeName()->insert( pRangeData ) )
-        delete pRangeData;
+    pDoc->GetRangeName()->insert( pRangeData );
 }
 
 void ScHTMLImport::WriteToDocument(
diff --git a/sc/source/ui/app/inputwin.cxx b/sc/source/ui/app/inputwin.cxx
index 49c35a437..4f377ef0f 100644
--- a/sc/source/ui/app/inputwin.cxx
+++ b/sc/source/ui/app/inputwin.cxx
@@ -1690,8 +1690,6 @@ void ScPosWnd::DoEnter()
                             aFunc.ModifyRangeNames( aNewRanges );
                             pViewSh->UpdateInputHandler(true);
                         }
-                        else
-                            delete pNew;        // shouldn't happen
                     }
                 }
                 else
diff --git a/sc/source/ui/docshell/docfunc.cxx b/sc/source/ui/docshell/docfunc.cxx
index b752383e5..89d99b938 100644
--- a/sc/source/ui/docshell/docfunc.cxx
+++ b/sc/source/ui/docshell/docfunc.cxx
@@ -4610,7 +4610,6 @@ void ScDocFunc::CreateOneName( ScRangeName& rList,
                 if (!rList.insert(pData))
                 {
                     OSL_FAIL("nanu?");
-                    delete pData;
                 }
             }
         }
diff --git a/sc/source/ui/namedlg/namedlg.cxx b/sc/source/ui/namedlg/namedlg.cxx
index 2452d83ad..157c31683 100644
--- a/sc/source/ui/namedlg/namedlg.cxx
+++ b/sc/source/ui/namedlg/namedlg.cxx
@@ -388,8 +388,7 @@ bool ScNameDlg::AddPushed()
                 //	  in ein Token-Array uebersetzt werden?)
                 if ( 0 == pNewEntry->GetErrCode() )
                 {
-                    rtl::OUString aUpper = aNewEntry;
-                    aUpper.toAsciiUpperCase();
+                    rtl::OUString aUpper( ScGlobal::pCharClass->upper( aNewEntry ) );
                     ScRangeData* pData = mpCurRangeName->findByUpperName(aUpper);
                     if (pData)
                     {
@@ -400,7 +399,7 @@ bool ScNameDlg::AddPushed()
                         mpImpl->Clear();
 
                     if ( !mpCurRangeName->insert( pNewEntry ) )
-                        delete pNewEntry;
+                        pNewEntry = NULL;
 
                     UpdateNames();
                     bSaved=false;
diff --git a/sc/source/ui/unoobj/nameuno.cxx b/sc/source/ui/unoobj/nameuno.cxx
index 52d90062a..baae08561 100644
--- a/sc/source/ui/unoobj/nameuno.cxx
+++ b/sc/source/ui/unoobj/nameuno.cxx
@@ -192,7 +192,7 @@ void ScNamedRangeObj::Modify_Impl( const String* pNewName, const ScTokenArray* p
     }
     else
     {
-        delete pNew;		//! uno::Exception/Fehler oder so
+        pNew = NULL;
         delete pNewRanges;
     }
 }
@@ -577,7 +577,7 @@ void SAL_CALL ScNamedRangesObj::addNewByName( const rtl::OUString& aName,
             }
             else
             {
-                delete pNew;
+                pNew = NULL;
                 delete pNewRanges;
             }
         }
diff --git a/sc/source/ui/view/viewfunc.cxx b/sc/source/ui/view/viewfunc.cxx
index 85f7b06a0..9a8587c9c 100644
--- a/sc/source/ui/view/viewfunc.cxx
+++ b/sc/source/ui/view/viewfunc.cxx
@@ -2945,10 +2945,8 @@ sal_Bool ScViewFunc::InsertName( const String& rName, const String& rSymbol,
         }
 
         if ( pList->insert( pNewEntry ) )
-        {
-            pNewEntry = NULL;	// nicht loeschen
             bOk = sal_True;
-        }
+        pNewEntry = NULL; // never delete, insert took ownership
 
         pDoc->CompileNameFormula( false );	// CompileFormulaString
         aModificator.SetDocumentModified();