Bug 98895 - Calc cell range search crashes open office if range is null
Summary: Calc cell range search crashes open office if range is null
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
(earliest affected)
Hardware: All All
: medium major
Assignee: Caolán McNamara
Whiteboard: target:5.2.0
Keywords: haveBacktrace
Depends on:
Reported: 2016-03-25 20:48 UTC by Anthony Zeeman
Modified: 2016-10-25 19:02 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:

Calc file with macro demonstrating bug (9.38 KB, application/vnd.oasis.opendocument.spreadsheet)
2016-03-25 20:48 UTC, Anthony Zeeman
console bt (17.18 KB, text/plain)
2016-03-25 23:27 UTC, Julien Nabet

Note You need to log in before you can comment on or make changes to this bug.
Description Anthony Zeeman 2016-03-25 20:48:10 UTC
Created attachment 123858 [details]
Calc file with macro demonstrating bug

LibreOffice will crash if a cell range search is attempted on an empty range as returned by "queryContentCells" on a cell range with no data. A sample Calc file with a demonstration macro is attached.
Click "Crash" on the toolbar to demonstrate the bug. On a sheet with data, the row number containing the data is returned and displayed in a message box. The search is then done on an empty sheet and LibreOffice will crash.
Comment 1 Julien Nabet 2016-03-25 23:27:44 UTC
Created attachment 123861 [details]
console bt

On pc Debian x86-64 with master sources updated today, I could reproduce this.
I attached a bt with symbols.
Comment 2 Julien Nabet 2016-03-25 23:52:44 UTC
Eike: with this straightforward patch,
diff --git a/sc/source/ui/unoobj/cellsuno.cxx b/sc/source/ui/unoobj/cellsuno.cxx
index 2e262b4..5b9cd4b 100644
--- a/sc/source/ui/unoobj/cellsuno.cxx
+++ b/sc/source/ui/unoobj/cellsuno.cxx
@@ -3974,7 +3974,7 @@ uno::Reference<uno::XInterface> ScCellRangesBase::Find_Impl(
                 SCTAB nTab;
                 if (pLastPos)
                     pLastPos->GetVars( nCol, nRow, nTab );
-                else
+                else if (!aRanges.empty())
                     nTab = lcl_FirstTab(aRanges);   //! mehrere Tabellen?
                     ScDocument::GetSearchAndReplaceStart( *pSearchItem, nCol, nRow );

I got no crash but got a popup with this instead:
"Inadmissible value or data type.
Index out of defined range.
Is it normal or is the patch wrong or insufficient?
Comment 3 Commit Notification 2016-05-25 16:40:05 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":


Resolves: tdf#98895 range search crashes open office if range is null

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:

Affected users are encouraged to test the fix and report feedback.
Comment 4 Caolán McNamara 2016-05-25 16:40:52 UTC
Might as well go brute force with an exception I reckon