ofz#23300 infinite loop

Change-Id: I0ee67e8efefa48942357340cae46bd7ece27e5b7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96085
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/lotuswordpro/source/filter/lwprowlayout.cxx b/lotuswordpro/source/filter/lwprowlayout.cxx
index e21505d06420..3321f294469e 100644
--- a/lotuswordpro/source/filter/lwprowlayout.cxx
+++ b/lotuswordpro/source/filter/lwprowlayout.cxx
@@ -404,7 +404,10 @@ void LwpRowLayout::ConvertCommonRow(rtl::Reference<XFTable> const & pXFTable, sa
                     auto nNumCols = pConnCell->GetNumcols();
                     if (!nNumCols)
                         throw std::runtime_error("loop in conversion");
-                    nCellEndCol = i + nNumCols - 1;
+                    auto nNewEndCol = i + nNumCols - 1;
+                    if (nNewEndCol > std::numeric_limits<sal_uInt8>::max())
+                        throw std::range_error("column index too large");
+                    nCellEndCol = nNewEndCol;
                     i = nCellEndCol;
                 }
                 xCell = pCellLayout->DoConvertCell(pTable->GetObjectID(),crowid,i);