[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - sw/source

[Caolán McNamara]

 sw/source/ui/vba/vbatablehelper.cxx |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

New commits:
commit 1be1d904188f83f1a996f4a741c39f0e6c14522e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 13 08:33:37 2015 +0100

    wrong row/col count limits
    
    thanks to ccsheller for noticing
    
    Change-Id: Idb0f39c48173445b750e0b85ac20b3f6b43691a7
    (cherry picked from commit 348cc2ce1e932f0fcaf90f9cf4d6dc9594f3f8a2)
    Reviewed-on: https://gerrit.libreoffice.org/17692
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sw/source/ui/vba/vbatablehelper.cxx b/sw/source/ui/vba/vbatablehelper.cxx
index 755ecd8..8a96054 100644
--- a/sw/source/ui/vba/vbatablehelper.cxx
+++ b/sw/source/ui/vba/vbatablehelper.cxx
@@ -61,7 +61,6 @@ sal_Int32 SwVbaTableHelper::getTabColumnsCount( sal_Int32 nRowIndex ) throw (uno
 sal_Int32 SwVbaTableHelper::getTabColumnsMaxCount( ) throw (uno::RuntimeException)
 {
     sal_Int32 nRet = 0;
-    //sal_Int32 nRowCount = mxTextTable->getRows()->getCount();
     sal_Int32 nRowCount = pTable->GetTabLines().size();
     for( sal_Int32 index = 0; index < nRowCount; index++ )
     {
@@ -141,15 +140,15 @@ SwTableBox* SwVbaTableHelper::GetTabBox( sal_Int32 nCol, sal_Int32 nRow ) throw
 {
     SwTableLines& rLines = pTable->GetTabLines();
     sal_Int32 nRowCount = rLines.size();
-    if( nRowCount < nRow )
+    if (nRow < 0 || nRow >= nRowCount)
         throw uno::RuntimeException();
 
-    SwTableBox* pStart = NULL;
     SwTableLine* pLine = rLines[ nRow ];
-    if( (sal_Int32)pLine->GetTabBoxes().size() < nCol )
+    sal_Int32 nColCount = pLine->GetTabBoxes().size();
+    if (nCol < 0 || nCol >= nColCount)
         throw uno::RuntimeException();
 
-    pStart = pLine->GetTabBoxes()[ nCol ];
+    SwTableBox* pStart = pLine->GetTabBoxes()[ nCol ];
 
     if( !pStart )
         throw uno::RuntimeException();