From 6e77dcd9d2605e55b57d0a379d87cdd2c48b62f4 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 11 Jun 2020 09:31:44 +0100
Subject: ofz#23300 infinite loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I0ee67e8efefa48942357340cae46bd7ece27e5b7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96085
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
---
 lotuswordpro/source/filter/lwprowlayout.cxx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'lotuswordpro')

diff --git a/lotuswordpro/source/filter/lwprowlayout.cxx b/lotuswordpro/source/filter/lwprowlayout.cxx
index e21505d06420..3321f294469e 100644
--- a/lotuswordpro/source/filter/lwprowlayout.cxx
+++ b/lotuswordpro/source/filter/lwprowlayout.cxx
@@ -404,7 +404,10 @@ void LwpRowLayout::ConvertCommonRow(rtl::Reference<XFTable> const & pXFTable, sa
                     auto nNumCols = pConnCell->GetNumcols();
                     if (!nNumCols)
                         throw std::runtime_error("loop in conversion");
-                    nCellEndCol = i + nNumCols - 1;
+                    auto nNewEndCol = i + nNumCols - 1;
+                    if (nNewEndCol > std::numeric_limits<sal_uInt8>::max())
+                        throw std::range_error("column index too large");
+                    nCellEndCol = nNewEndCol;
                     i = nCellEndCol;
                 }
                 xCell = pCellLayout->DoConvertCell(pTable->GetObjectID(),crowid,i);
-- 
cgit v1.2.3