[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - sc/qa sc/source

[Caolán McNamara]

 sc/qa/unit/data/xls/pass/ooo56295-1.xls |binary
 sc/source/ui/view/output.cxx            |    5 ++++-
 2 files changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 0da689ecb8d81cbcf1abf9cb0055cb650c8e4350
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Nov 3 09:53:47 2015 +0000

    read past end of pCellInfo
    
    Change-Id: Ic024f8dd3aaf368877f5914c6106164508760da8
    Reviewed-on: https://gerrit.libreoffice.org/19752
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 5ae015fc74330ac4c24b67370c59518084f1d201)
    Reviewed-on: https://gerrit.libreoffice.org/19755

diff --git a/sc/qa/unit/data/xls/pass/ooo56295-1.xls b/sc/qa/unit/data/xls/pass/ooo56295-1.xls
new file mode 100644
index 0000000..bd727c9
Binary files /dev/null and b/sc/qa/unit/data/xls/pass/ooo56295-1.xls differ
diff --git a/sc/source/ui/view/output.cxx b/sc/source/ui/view/output.cxx
index 9dfc3b7..2b04c0f 100644
--- a/sc/source/ui/view/output.cxx
+++ b/sc/source/ui/view/output.cxx
@@ -1059,7 +1059,10 @@ void ScOutputData::DrawBackground()
 
                     for (SCCOL nMerged = 0; nMerged < nMergedCells; ++nMerged)
                     {
-                        nPosX += pRowInfo[0].pCellInfo[nX+nOldMerged+nMerged].nWidth * nLayoutSign;
+                        SCCOL nCol = nX+nOldMerged+nMerged;
+                        if (nCol > nX2+2)
+                            break;
+                        nPosX += pRowInfo[0].pCellInfo[nCol].nWidth * nLayoutSign;
                     }
                 }
                 drawCells( NULL, NULL, pOldColor, pOldBackground, aRect, nPosX, nSignedOneX, mpDev, NULL, pOldDataBarInfo, NULL, pOldIconSetInfo );