Bug#702824: calligrasheets: crash when entering double-quotes and some other special characters in formula

["Alexis M." <ldxngx@gmail.com>]

Package: calligrasheets
Version: 1:2.4.4-2
Severity: important
Tags: patch

When entering:

="

In a cell, calligra sheets crash when entering the double quote.
This disable the usability of using double-quotes in formula

This bug has been reported upstream:
https://bugs.kde.org/show_bug.cgi?id=304825 and has been corrected (but not
verified)

The commit that corrected the bug is here (there is also a link in the bug page
comment 1 from Marijn Kruisselbrink):
http://quickgit.kde.org/?p=calligra.git&a=commit&h=8d91c11ccbe80367e1960db6309c294d2d92f69b


The attached patches are directly from the commit.



-- System Information:
Debian Release: 7.0
  APT prefers testing
  APT policy: (900, 'testing')
Architecture: i386 (i686)

Kernel: Linux 3.2.35backlightfix (SMP w/2 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages calligrasheets depends on:
ii  calligra-libs      1:2.4.4-2
ii  kde-runtime        4:4.8.4-2
ii  libc6              2.13-38
ii  libgcc1            1:4.7.2-5
ii  libgsl0ldbl        1.15+dfsg.2-2
ii  libkcmutils4       4:4.8.4-4
ii  libkde3support4    4:4.8.4-4
ii  libkdecore5        4:4.8.4-4
ii  libkdeui5          4:4.8.4-4
ii  libkhtml5          4:4.8.4-4
ii  libkio5            4:4.8.4-4
ii  libknotifyconfig4  4:4.8.4-4
ii  libkparts4         4:4.8.4-4
ii  libkrosscore4      4:4.8.4-4
ii  libqt4-dbus        4:4.8.2+dfsg-11
ii  libqt4-qt3support  4:4.8.2+dfsg-11
ii  libqt4-sql         4:4.8.2+dfsg-11
ii  libqt4-xml         4:4.8.2+dfsg-11
ii  libqtcore4         4:4.8.2+dfsg-11
ii  libqtgui4          4:4.8.2+dfsg-11
ii  libstdc++6         4.7.2-5
ii  zlib1g             1:1.2.7.dfsg-13

calligrasheets recommends no packages.

Versions of packages calligrasheets suggests:
ii  khelpcenter4  4:4.8.4-2

-- no debconf information

--- a/sheets/Formula.cpp
+++ b/sheets/Formula.cpp
@@ -656,7 +656,8 @@
     tokens.reserve(50);
 
     ++data;
-    const QChar *start = data;
+    const QChar * const start = data;
+    const QChar * const end = start + expr.length();
     const QChar *tokenStart = data;
     const QChar *cellStart = data;
 
@@ -667,9 +668,9 @@
     QString token(length, QChar());
     token.reserve(length); // needed to not realloc at the resize at the end
     QChar * out = token.data();
-    QChar * outStart = token.data();
-
-    while (state != Finish) {
+    QChar * const outStart = token.data();
+
+    while (state != Finish && data < end) {
         switch (state) {
         case Start:
             tokenStart = data;
@@ -1060,7 +1061,7 @@
     }
 
     // parse error if any text remains
-    if (!data->isNull())  {
+    if (data+1 < end)  {
         tokens.append(Token(Token::Unknown, expr.mid(tokenStart - start), tokenStart - start));
         parseError = true;
     }

--- a/sheets/tests/TestFormula.cpp
+++ b/sheets/tests/TestFormula.cpp
@@ -177,9 +177,13 @@
     // invalid formulas, can't be parsed correctly
     CHECK_TOKENIZE("+1.23E", QString());
 
+    // incomplete formulas
+    CHECK_TOKENIZE("COMPARE(\"", "xo");
+    CHECK_TOKENIZE("SHEETS(Sheet2!", "");
+
     // empty parameter
     CHECK_TOKENIZE("IF(A1;A2;)", "xococoo");
-    CHECK_TOKENIZE("=OFFSET(Sheet2'!B7;0;0)", "");
+    CHECK_TOKENIZE("OFFSET(Sheet2'!B7;0;0)", "");
 
     // function cascade
     CHECK_TOKENIZE("SUM(ABS(-1);ABS(-1))", "xoxooiooxooioo");