[Libreoffice-commits] .: Branch 'libreoffice-3-5-5' - writerfilter/source

[Petr Mladek]

 writerfilter/source/dmapper/DomainMapperTableManager.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 6b989477dc3d4b1c3296f65e18028090669cf9f2
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Tue Jun 12 19:50:23 2012 +0200

    Resolves: fdo#49178 CRASH when FILEOPEN particular RTF
    
    (cherry picked from commit 104badf31c8a39994cadc460561bfa01e428b67b)
    
    Signed-off-by: Miklos Vajna <vmiklos at suse.cz>
    Signed-off-by: Caolán McNamara <caolanm at redhat.com>
    Signed-off-by: Petr Mladek <pmladek at suse.cz>
    
    Change-Id: Idd938980b91ec8b822a92dfd7013a20fe5b6f498

diff --git a/writerfilter/source/dmapper/DomainMapperTableManager.cxx b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
index b4aaf3d..7403b42 100644
--- a/writerfilter/source/dmapper/DomainMapperTableManager.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
@@ -486,8 +486,9 @@ void DomainMapperTableManager::endOfRowAction()
 
         sal_Int16 nSum = 0;
         sal_uInt32 nPos = 0;
+        sal_uInt32 nSizeTableGrid = pTableGrid->size();
         // Ignoring the i=0 case means we assume that the width of the last cell matches the table width
-        for (int i = m_nCell; i > 1; i--)
+        for (sal_uInt32 i = m_nCell; i > 1 && nSizeTableGrid >= i; i--)
         {
             nSum += (*pTableGrid.get())[pTableGrid->size() - i]; // Size of the current cell
             pSeparators[nPos].Position = nSum * nFullWidthRelative / nFullWidth; // Relative position