From 9faf077b85098436ac29b9369bfc7d8a9286fbd3 Mon Sep 17 00:00:00 2001
From: Eike Rathke <erack@redhat.com>
Date: Mon, 23 Jan 2012 15:43:50 +0100
Subject: [PATCH 4/5] resolved rhbz#783556 crash in ScMatrix::GetDimensons()
 from ScInterpreter

* Interpreter tried to access a nonexistent matrix for external reference.
* In ScInterpreter::PopExternalDoubleRef(ScMatrixRef& rMat) set error for
  unexpected conditions. In caller or descendants check for error or presence
  of ScMatrix.
---
 sc/source/core/tool/interpr4.cxx |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
index 07ff54b..424c713 100644
--- a/sc/source/core/tool/interpr4.cxx
+++ b/sc/source/core/tool/interpr4.cxx
@@ -1285,6 +1285,8 @@ ScDBRangeBase* ScInterpreter::PopDBDoubleRef()
                 pMat = PopMatrix();
             else
                 PopExternalDoubleRef(pMat);
+            if (nGlobalError)
+                break;
             return new ScDBExternalRange(pDok, pMat);
         }
         default:
@@ -1535,7 +1537,14 @@ void ScInterpreter::PopExternalDoubleRef(ScMatrixRef& rMat)
     // references, which means the array should only contain a
     // single matrix token.
     ScToken* p = static_cast<ScToken*>(pArray->First());
-    rMat = p->GetMatrix();
+    if (!p || p->GetType() != svMatrix)
+        SetError( errIllegalParameter);
+    else
+    {
+        rMat = p->GetMatrix();
+        if (!rMat)
+            SetError( errUnknownVariable);
+    }
 }
 
 void ScInterpreter::GetExternalDoubleRef(
-- 
1.7.7.6