summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-11-03 09:53:47 +0000
committerEike Rathke <erack@redhat.com>2015-11-03 13:52:39 +0000
commit5ae015fc74330ac4c24b67370c59518084f1d201 (patch)
treed4fa6ca9587dcb0f0297921ed120f279d3851681
parentc6822f927a73e5b2ee72208b139b6808116fe1e0 (diff)
read past end of pCellInfo
Change-Id: Ic024f8dd3aaf368877f5914c6106164508760da8 Reviewed-on: https://gerrit.libreoffice.org/19752 Reviewed-by: Eike Rathke <erack@redhat.com> Tested-by: Eike Rathke <erack@redhat.com>
-rw-r--r--sc/qa/unit/data/xls/pass/ooo56295-1.xlsbin0 -> 17408 bytes
-rw-r--r--sc/source/ui/view/output.cxx5
2 files changed, 4 insertions, 1 deletions
diff --git a/sc/qa/unit/data/xls/pass/ooo56295-1.xls b/sc/qa/unit/data/xls/pass/ooo56295-1.xls
new file mode 100644
index 000000000000..bd727c9bcfa0
--- /dev/null
+++ b/sc/qa/unit/data/xls/pass/ooo56295-1.xls
Binary files differ
diff --git a/sc/source/ui/view/output.cxx b/sc/source/ui/view/output.cxx
index 468953af8272..83c879875e21 100644
--- a/sc/source/ui/view/output.cxx
+++ b/sc/source/ui/view/output.cxx
@@ -1100,7 +1100,10 @@ void ScOutputData::DrawBackground(vcl::RenderContext& rRenderContext)
for (SCCOL nMerged = 0; nMerged < nMergedCells; ++nMerged)
{
- nPosX += pRowInfo[0].pCellInfo[nX+nOldMerged+nMerged].nWidth * nLayoutSign;
+ SCCOL nCol = nX+nOldMerged+nMerged;
+ if (nCol > nX2+2)
+ break;
+ nPosX += pRowInfo[0].pCellInfo[nCol].nWidth * nLayoutSign;
}
}