Fix buffer overflow in linear regression.

[pspp] / src / ui / gui / psppire-variable-sheet.c

diff --git a/src/ui/gui/psppire-variable-sheet.c b/src/ui/gui/psppire-variable-sheet.c
index 35ee7d6085d636083ae072f99be88ce8654bb799..149403743aa16fe5404a1212b5ee02271708a5d2 100644 (file)
--- a/src/ui/gui/psppire-variable-sheet.c
+++ b/src/ui/gui/psppire-variable-sheet.c
@@ -248,6 +248,13 @@ delete_variables (SswSheet *sheet)
   PsppireDict *dict = NULL;
   g_object_get (sheet, "data-model", &dict, NULL);
 
+  if (range->start_x > range->end_x)
+    {
+      gint temp = range->start_x;
+      range->start_x = range->end_x;
+      range->end_x = temp;
+    }
+
   psppire_dict_delete_variables (dict, range->start_y,
                                 (range->end_y - range->start_y + 1));
 
@@ -305,6 +312,10 @@ change_var_property (PsppireVariableSheet *var_sheet, gint col, gint row, const
   PsppireDict *dict = NULL;
   g_object_get (var_sheet, "data-model", &dict, NULL);
 
+  int n_rows = psppire_dict_get_var_cnt (dict);
+  if (row > n_rows)
+    return;
+
   /* Return the IDXth variable */
   struct variable *var =  psppire_dict_get_variable (dict, row);
 
@@ -434,7 +445,7 @@ psppire_variable_sheet_finalize (GObject *object)
   g_free (sheet->value_label_dispatch);
   g_free (sheet->missing_values_dispatch);
   g_free (sheet->var_type_dispatch);
-  
+
   if (G_OBJECT_CLASS (parent_class)->finalize)
     (*G_OBJECT_CLASS (parent_class)->finalize) (object);
 }
@@ -502,7 +513,7 @@ is_printable_key (gint keyval)
       return FALSE;
       break;
     }
-  
+
   return (0 != gdk_keyval_to_unicode (keyval));
 }
 
@@ -536,7 +547,7 @@ on_button_press (GtkWidget *w, GdkEventButton *e, gpointer user_data)
   d->payload (d->sheet);
   return TRUE;
 }
-  
+
 static void
 on_edit_start (GtkCellRenderer *renderer,
      GtkCellEditable *editable,
@@ -548,7 +559,7 @@ on_edit_start (GtkCellRenderer *renderer,
                    G_CALLBACK (on_key_press), user_data);
   g_signal_connect (editable, "button-press-event",
                    G_CALLBACK (on_button_press), user_data);
-  
+
 }
 
 static void
@@ -579,7 +590,7 @@ psppire_variable_sheet_init (PsppireVariableSheet *sheet)
   g_signal_connect_after (sheet->var_type_renderer,
                          "editing-started", G_CALLBACK (on_edit_start),
                          sheet->var_type_dispatch);
-  
+
   sheet->row_popup = create_var_row_header_popup_menu (sheet);