6 files changed, 43 insertions, 5 deletions

diff --git a/compilerplugins/clang/test/writeonlyvars.cxx b/compilerplugins/clang/test/writeonlyvars.cxx
index 0fc141f62dd2..fc521fa7d417 100644
--- a/compilerplugins/clang/test/writeonlyvars.cxx
+++ b/compilerplugins/clang/test/writeonlyvars.cxx
@@ -24,6 +24,7 @@
 #if defined LIBO_USE_SOURCE_LOCATION
 // expected-error@o3tl/runtimetooustring.hxx:* {{read s [loplugin:writeonlyvars]}}
 // expected-error@o3tl/runtimetooustring.hxx:* {{write s [loplugin:writeonlyvars]}}
+// expected-error@o3tl/safeint.hxx:* {{read res [loplugin:writeonlyvars]}}
 #if !defined NDEBUG
 // expected-error@o3tl/runtimetooustring.hxx:* {{read ok [loplugin:writeonlyvars]}}
 #endif
diff --git a/connectivity/source/drivers/dbase/DIndexIter.cxx b/connectivity/source/drivers/dbase/DIndexIter.cxx
index 37e28a073f4c..5420d044d5c6 100644
--- a/connectivity/source/drivers/dbase/DIndexIter.cxx
+++ b/connectivity/source/drivers/dbase/DIndexIter.cxx
@@ -262,7 +262,8 @@ ONDXKey* OIndexIterator::GetNextKey()
                 sal_uInt16 nPos = pParentPage->Search(pPage);
                 if (nPos != pParentPage->Count() - 1)
                 { // page found
-                    pPage = (*pParentPage)[nPos + 1].GetChild(m_xIndex.get(), pParentPage);
+                    pPage = (*pParentPage)[o3tl::sanitizing_inc(nPos)].GetChild(m_xIndex.get(),
+                                                                                pParentPage);
                     break;
                 }
             }
diff --git a/include/o3tl/safeint.hxx b/include/o3tl/safeint.hxx
index a32c6beea142..80f8b45c4042 100644
--- a/include/o3tl/safeint.hxx
+++ b/include/o3tl/safeint.hxx
@@ -231,6 +231,42 @@ template<typename T> [[nodiscard]] inline T sanitizing_min(T a, T b)
     return std::min(a, b);
 }
 
+// To sanitize in/de-crementing value where the result is known by the caller to be guaranteed to fit in
+// the source type range without over/under-flow
+[[nodiscard]] inline unsigned short sanitizing_inc(unsigned short value)
+{
+    int res = value + 1;
+    assert(res <= std::numeric_limits<unsigned short>::max() &&
+           "nValue was supposed to be incrementable without overflow");
+    return static_cast<unsigned short>(res);
+}
+
+[[nodiscard]] inline unsigned short sanitizing_dec(unsigned short value)
+{
+    int res = value - 1;
+    assert(res >= 0 &&
+           "nValue was supposed to be decrementable without underflow");
+    return static_cast<unsigned short>(res);
+}
+
+[[nodiscard]] inline short sanitizing_inc(short value)
+{
+    int res = value + 1;
+    assert(res >= std::numeric_limits<short>::min() &&
+           res <= std::numeric_limits<short>::max() &&
+           "nValue was supposed to be incrementable without overflow");
+    return static_cast<short>(res);
+}
+
+[[nodiscard]] inline short sanitizing_dec(short value)
+{
+    int res = value - 1;
+    assert(res >= std::numeric_limits<short>::min() &&
+           res <= std::numeric_limits<short>::max() &&
+           "nValue was supposed to be decrementable without underflow");
+    return static_cast<short>(res);
+}
+
 }
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/lotuswordpro/source/filter/lwptablelayout.cxx b/lotuswordpro/source/filter/lwptablelayout.cxx
index 31d925fc6d72..f940b8c7d672 100644
--- a/lotuswordpro/source/filter/lwptablelayout.cxx
+++ b/lotuswordpro/source/filter/lwptablelayout.cxx
@@ -809,7 +809,7 @@ void LwpTableLayout::ParseTable()
                 SAL_WARN("lwp", "truncating HeadingRow for fuzzing performance");
                 nEndHeadRow = nStartHeadRow + 128;
             }
-            nContentRow = ConvertHeadingRow(m_pXFTable,nStartHeadRow,nEndHeadRow+1);
+            nContentRow = ConvertHeadingRow(m_pXFTable, nStartHeadRow, o3tl::sanitizing_inc(nEndHeadRow));
         }
     }
 
diff --git a/sc/source/core/data/document.cxx b/sc/source/core/data/document.cxx
index 3b9c11157145..b631e74a6a22 100644
--- a/sc/source/core/data/document.cxx
+++ b/sc/source/core/data/document.cxx
@@ -5272,7 +5272,7 @@ void ScDocument::GetBorderLines( SCCOL nCol, SCROW nRow, SCTAB nTab,
 
     if ( nCol > 0 )
     {
-        const SvxBorderLine* pOther = GetEffItem( nCol-1, nRow, nTab, ATTR_BORDER )->GetRight();
+        const SvxBorderLine* pOther = GetEffItem( o3tl::sanitizing_dec(nCol), nRow, nTab, ATTR_BORDER )->GetRight();
         if ( ScHasPriority( pOther, pLeftLine ) )
             pLeftLine = pOther;
     }
@@ -5284,7 +5284,7 @@ void ScDocument::GetBorderLines( SCCOL nCol, SCROW nRow, SCTAB nTab,
     }
     if ( nCol < MaxCol() )
     {
-        const SvxBorderLine* pOther = GetEffItem( nCol+1, nRow, nTab, ATTR_BORDER )->GetLeft();
+        const SvxBorderLine* pOther = GetEffItem( o3tl::sanitizing_inc(nCol), nRow, nTab, ATTR_BORDER )->GetLeft();
         if ( ScHasPriority( pOther, pRightLine ) )
             pRightLine = pOther;
     }
diff --git a/sw/source/ui/index/cnttab.cxx b/sw/source/ui/index/cnttab.cxx
index 74396f875e7f..d1146b5a05b5 100644
--- a/sw/source/ui/index/cnttab.cxx
+++ b/sw/source/ui/index/cnttab.cxx
@@ -2809,7 +2809,7 @@ void SwTokenWindow::SetForm(SwForm& rForm, sal_uInt16 nL)
     if(m_nLevel < MAXLEVEL || rForm.GetTOXType() == TOX_AUTHORITIES)
     {
         // #i21237#
-        SwFormTokens aPattern = m_pForm->GetPattern(m_nLevel + 1);
+        SwFormTokens aPattern = m_pForm->GetPattern(o3tl::sanitizing_inc(m_nLevel));
         bool bLastWasText = false; //assure alternating text - code - text
 
         SwTOXWidget* pSetActiveControl = nullptr;