From 190de6c787915456435c0d57cb08a55a5f94c1a1 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 26 Mar 2018 09:23:48 +0100
Subject: forcepoint #30 check validity of group range

Change-Id: Ie0611f36809b051ce46030e44c137b4e1f8d2fe0
Reviewed-on: https://gerrit.libreoffice.org/51864
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
(cherry picked from commit 6969f1fbfd1c8ead222af416ff86f30e2f74f00e)
---
 sc/source/core/data/column3.cxx | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'sc/source')

diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 961bf244df60..a50856290c35 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -3091,6 +3091,8 @@ public:
                     xPrevGrp->mnLength += xCurGrp->mnLength;
                     pCur->SetCellGroup(xPrevGrp);
                     sc::formula_block::iterator itGrpEnd = it;
+                    if (xCurGrp->mnLength > std::distance(itGrpEnd, itEnd))
+                        throw css::lang::IllegalArgumentException();
                     std::advance(itGrpEnd, xCurGrp->mnLength);
                     for (++it; it != itGrpEnd; ++it)
                     {
-- 
cgit