ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

crashtesting: leave a result on the stack after running a callable

Browse Source 
Interpreting a callable consumes its arguments off the interpreter stack
and must leave exactly one result token behind.

Two paths returned without pushing anything: a lambda whose result was
empty, and a macro whose arguments could not be built.

Each such call left the stack one entry short, so a later token read
past the stack base. That surfaces later as the "underflow" abort in
Interpret, and as the matrix count mismatch in ConvertMatrixParameters.

Push the error, or an empty result, on those two paths.

crash converting forum-en-34250.ods to xlsx:

  #21 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4328
  #22 ScFormulaCell::InterpretTail at sc/source/core/data/formulacell.cxx:2201
  #24 ScFormulaCell::GetMatrix at sc/source/core/data/formulacell.cxx:3267
  #25 ScInterpreter::ScMatRef at sc/source/core/tool/interpr5.cxx:3764
  #26 ScInterpreter::DispatchOpCode at sc/source/core/tool/interpr4.cxx:4050
  #27 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4333
  #30 ScFormulaCell::MaybeInterpret at sc/inc/formulacell.hxx:515

the same problem also aborts in ScInterpreter::ConvertMatrixParameters
at sc/source/core/tool/interpr4.cxx:1555.

since:

commit 837cf12bc45c72e08c4629d07a43c27763b263b2
Date:   Sat Jun 20 23:28:17 2026 -0400

    Implemented callables as first-class objects in Calc formulas

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I46a9fa77872ac1c540f9b0904da2e3f9397e71c9
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6153
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f239eafadbb1c539d0c6dfbb459ca25bc10b7456)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207976
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-07-12 23:12:03 +02:00
committed by Xisco Fauli
parent ea2543a570
commit cd489d2a8b
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sc/source/core/tool/interpr1.cxx
+6
View File
@@ -10872,6 +10872,10 @@ void ScInterpreter::ScCall( FormulaCallableRef pCallable, const std::vector<Form
}
else if (xLambdaResult)
PushTokenRef(xLambdaResult);
else if (nGlobalError != FormulaError::NONE)
PushError(nGlobalError);
else
PushNoValue();
}
else if (eOpCode == ocMacro)
{
@@ -11009,6 +11013,8 @@ void ScInterpreter::ScCall( FormulaCallableRef pCallable, const std::vector<Form
else
PushString( refRes->GetOUString() );
}
else
PushError(nGlobalError); // the arguments could not be built
// prevent cycles from leaking memory
refArgs->Clear();