[Libreoffice-commits] core.git: Branch 'libreoffice-6-0' - sc/qa sc/source

[Caolán McNamara]

 sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls |binary
 sc/source/core/data/column3.cxx                       |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit 6969f1fbfd1c8ead222af416ff86f30e2f74f00e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Mar 26 09:23:48 2018 +0100

    forcepoint #30 check validity of group range
    
    Change-Id: Ie0611f36809b051ce46030e44c137b4e1f8d2fe0
    Reviewed-on: https://gerrit.libreoffice.org/51864
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls
new file mode 100755
index 000000000000..1aca9c7f113e
Binary files /dev/null and b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls differ
diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 961bf244df60..a50856290c35 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -3091,6 +3091,8 @@ public:
                     xPrevGrp->mnLength += xCurGrp->mnLength;
                     pCur->SetCellGroup(xPrevGrp);
                     sc::formula_block::iterator itGrpEnd = it;
+                    if (xCurGrp->mnLength > std::distance(itGrpEnd, itEnd))
+                        throw css::lang::IllegalArgumentException();
                     std::advance(itGrpEnd, xCurGrp->mnLength);
                     for (++it; it != itGrpEnd; ++it)
                     {