ScLet and ScLambda read the parameter-name token's string without checking
GetType() first, so a token that isn't a string name faults on load, e.g.
forums/xlsx/forum-mso-en4-789942.xlsx:
#0 rtl::str::acquire (pThis=0x20d) at sal/rtl/strtmpl.hxx:735
#6 std::vector<OUString>::push_back
#8 ScInterpreter::ScLet at sc/source/core/tool/interpr1.cxx:10938
#9 ScInterpreter::DispatchOpCode (eOp=ocLet)
#13 ScFormulaCell::MaybeInterpret
#15 ScCellFormat::GetString
#17 ScColumn::GetRangeScriptType
#24 GetOptimalHeightsInColumn
ScLet used to have this check until it was rewritten, the new ScLambda
never had it, since:
commit 6ad6aebb83305608788c878909cd77c29b298271
Date: Sat Jun 20 23:50:39 2026 -0400
Implemented LAMBDA and ISOMITTED for Calc
use the same fix as:
commit 4f5764a223f86ceea1eca70cbec55eb8aebea1f3
Date: Tue May 5 11:45:29 2026 +0100
crashtesting: fix ScLet/ScMatch/IterateParametersIf[s] crashes
Add a GetStringNameToken() helper for this and use it in ScLet, ScLambda
and the dynamic_cast calls in callable.cxx.
see also:
commit 65da502b7b40bd3bcad0cfd146716e815c72d48d
Date: Thu Apr 16 12:31:01 2026 +0200
reduce virtual calling in String*Token
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I7ce591bf5e53538aa947fafa9607b7339d715aaa
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6107
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 8b1f9cc417d914d72ea223815e8306bcb07299ec)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207977
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Caolán McNamara
0500f647f3