Check the validity of row ranges after after the data area shrinkage.

Or else it might crash again in the pivot layout dialog.

Change-Id: I2254e5901f4736fffc6940346a866fc1f22b7c7f

1 files changed, 10 insertions, 1 deletions

diff --git a/sc/source/core/data/dpcache.cxx b/sc/source/core/data/dpcache.cxx
index 724c842a4a12..5f075a30e516 100644
--- a/sc/source/core/data/dpcache.cxx
+++ b/sc/source/core/data/dpcache.cxx
@@ -303,7 +303,7 @@ bool ScDPCache::InitFromDoc(ScDocument* pDoc, const ScRange& rRange)
     SCROW nEndRow = rRange.aEnd.Row();
 
     // Sanity check
-    if (!ValidRow(nStartRow) || !ValidRow(nEndRow) || nEndRow-nStartRow <= 0)
+    if (!ValidRow(nStartRow) || !ValidRow(nEndRow) || nEndRow <= nStartRow)
         return false;
 
     sal_uInt16 nStartCol = rRange.aStart.Col();
@@ -322,6 +322,15 @@ bool ScDPCache::InitFromDoc(ScDocument* pDoc, const ScRange& rRange)
     bool bTailEmptyRows = nEndRow > nRow2; // Trailing empty rows exist.
     nEndRow = nRow2;
 
+    if (nEndRow <= nStartRow)
+    {
+        // Check this again since the end row position has changed. It's
+        // possible that the new end row becomes lower than the start row
+        // after the shrinkage.
+        Clear();
+        return false;
+    }
+
     maFields.reserve(mnColumnCount);
     for (size_t i = 0; i < static_cast<size_t>(mnColumnCount); ++i)
         maFields.push_back(new Field);