From e1d8524f2384c4dab01f6e99c6672ca35b3a3a07 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Mon, 26 Mar 2018 09:23:48 +0100 Subject: forcepoint #30 check validity of group range Change-Id: Ie0611f36809b051ce46030e44c137b4e1f8d2fe0 Reviewed-on: https://gerrit.libreoffice.org/51865 Tested-by: Jenkins Reviewed-by: Michael Stahl (cherry picked from commit e82beb0812f2f4742b80ba1f63a026cbe77f5b25) --- sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls | Bin 0 -> 163886 bytes sc/source/core/data/column3.cxx | 2 ++ 2 files changed, 2 insertions(+) create mode 100755 sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls diff --git a/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls new file mode 100755 index 000000000000..1aca9c7f113e Binary files /dev/null and b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls differ diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx index 4374d47f66d2..473b6bccce23 100644 --- a/sc/source/core/data/column3.cxx +++ b/sc/source/core/data/column3.cxx @@ -3085,6 +3085,8 @@ public: xPrevGrp->mnLength += xCurGrp->mnLength; pCur->SetCellGroup(xPrevGrp); sc::formula_block::iterator itGrpEnd = it; + if (xCurGrp->mnLength > std::distance(itGrpEnd, itEnd)) + throw css::lang::IllegalArgumentException(); std::advance(itGrpEnd, xCurGrp->mnLength); for (++it; it != itGrpEnd; ++it) { -- cgit