[Libreoffice-commits] core.git: sc/qa sc/source

[Caolán McNamara]

 sc/qa/unit/data/xls/pass/ooo56295-1.xls |binary
 sc/source/ui/view/output.cxx            |    5 ++++-
 2 files changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 5ae015fc74330ac4c24b67370c59518084f1d201
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Nov 3 09:53:47 2015 +0000

    read past end of pCellInfo
    
    Change-Id: Ic024f8dd3aaf368877f5914c6106164508760da8
    Reviewed-on: https://gerrit.libreoffice.org/19752
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>

diff --git a/sc/qa/unit/data/xls/pass/ooo56295-1.xls b/sc/qa/unit/data/xls/pass/ooo56295-1.xls
new file mode 100644
index 0000000..bd727c9
Binary files /dev/null and b/sc/qa/unit/data/xls/pass/ooo56295-1.xls differ
diff --git a/sc/source/ui/view/output.cxx b/sc/source/ui/view/output.cxx
index 468953a..83c8798 100644
--- a/sc/source/ui/view/output.cxx
+++ b/sc/source/ui/view/output.cxx
@@ -1100,7 +1100,10 @@ void ScOutputData::DrawBackground(vcl::RenderContext& rRenderContext)
 
                     for (SCCOL nMerged = 0; nMerged < nMergedCells; ++nMerged)
                     {
-                        nPosX += pRowInfo[0].pCellInfo[nX+nOldMerged+nMerged].nWidth * nLayoutSign;
+                        SCCOL nCol = nX+nOldMerged+nMerged;
+                        if (nCol > nX2+2)
+                            break;
+                        nPosX += pRowInfo[0].pCellInfo[nCol].nWidth * nLayoutSign;
                     }
                 }