diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-11-03 09:53:47 +0000 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2015-11-03 13:52:39 +0000 |
| commit | 5ae015fc74330ac4c24b67370c59518084f1d201 (patch) | |
| tree | d4fa6ca9587dcb0f0297921ed120f279d3851681 /sc/source/ui/view/output.cxx | |
| parent | c6822f927a73e5b2ee72208b139b6808116fe1e0 (diff) | |
read past end of pCellInfo
Change-Id: Ic024f8dd3aaf368877f5914c6106164508760da8
Reviewed-on: https://gerrit.libreoffice.org/19752
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>
Diffstat (limited to 'sc/source/ui/view/output.cxx')
| -rw-r--r-- | sc/source/ui/view/output.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sc/source/ui/view/output.cxx b/sc/source/ui/view/output.cxx index 468953af8272..83c879875e21 100644 --- a/sc/source/ui/view/output.cxx +++ b/sc/source/ui/view/output.cxx @@ -1100,7 +1100,10 @@ void ScOutputData::DrawBackground(vcl::RenderContext& rRenderContext) for (SCCOL nMerged = 0; nMerged < nMergedCells; ++nMerged) { - nPosX += pRowInfo[0].pCellInfo[nX+nOldMerged+nMerged].nWidth * nLayoutSign; + SCCOL nCol = nX+nOldMerged+nMerged; + if (nCol > nX2+2) + break; + nPosX += pRowInfo[0].pCellInfo[nCol].nWidth * nLayoutSign; } } |