diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-11-03 09:53:47 +0000 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2015-11-03 18:10:31 +0100 |
| commit | be11143b86475b07d525a7ef651a704ddf6383d4 (patch) | |
| tree | 35b7ce7e6deb59ff105142072e299e859a9d7ddd | |
| parent | 97ea231bcdf796a1ab2a1a505e2c483f60fcc8f1 (diff) | |
read past end of pCellInfo
Change-Id: Ic024f8dd3aaf368877f5914c6106164508760da8
Reviewed-on: https://gerrit.libreoffice.org/19752
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>
(cherry picked from commit 5ae015fc74330ac4c24b67370c59518084f1d201)
Reviewed-on: https://gerrit.libreoffice.org/19755
(cherry picked from commit 0da689ecb8d81cbcf1abf9cb0055cb650c8e4350)
| -rw-r--r-- | sc/qa/unit/data/xls/pass/ooo56295-1.xls | bin | 0 -> 17408 bytes | |||
| -rw-r--r-- | sc/source/ui/view/output.cxx | 5 |
2 files changed, 4 insertions, 1 deletions
diff --git a/sc/qa/unit/data/xls/pass/ooo56295-1.xls b/sc/qa/unit/data/xls/pass/ooo56295-1.xls Binary files differnew file mode 100644 index 000000000000..bd727c9bcfa0 --- /dev/null +++ b/sc/qa/unit/data/xls/pass/ooo56295-1.xls diff --git a/sc/source/ui/view/output.cxx b/sc/source/ui/view/output.cxx index 9dfc3b7eb4d8..2b04c0f04e04 100644 --- a/sc/source/ui/view/output.cxx +++ b/sc/source/ui/view/output.cxx @@ -1059,7 +1059,10 @@ void ScOutputData::DrawBackground() for (SCCOL nMerged = 0; nMerged < nMergedCells; ++nMerged) { - nPosX += pRowInfo[0].pCellInfo[nX+nOldMerged+nMerged].nWidth * nLayoutSign; + SCCOL nCol = nX+nOldMerged+nMerged; + if (nCol > nX2+2) + break; + nPosX += pRowInfo[0].pCellInfo[nCol].nWidth * nLayoutSign; } } drawCells( NULL, NULL, pOldColor, pOldBackground, aRect, nPosX, nSignedOneX, mpDev, NULL, pOldDataBarInfo, NULL, pOldIconSetInfo ); |