[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - sc/qa sc/source

[Caolán McNamara]

 sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls |binary
 sc/source/core/data/column3.cxx                       |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit e82beb0812f2f4742b80ba1f63a026cbe77f5b25
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Mar 26 09:23:48 2018 +0100

    forcepoint #30 check validity of group range
    
    Change-Id: Ie0611f36809b051ce46030e44c137b4e1f8d2fe0
    Reviewed-on: https://gerrit.libreoffice.org/51865
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>

diff --git a/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls
new file mode 100755
index 000000000000..1aca9c7f113e
Binary files /dev/null and b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls differ
diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 8e36534e8461..d3e3e24d88c5 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -3089,6 +3089,8 @@ public:
                     xPrevGrp->mnLength += xCurGrp->mnLength;
                     pCur->SetCellGroup(xPrevGrp);
                     sc::formula_block::iterator itGrpEnd = it;
+                    if (xCurGrp->mnLength > std::distance(itGrpEnd, itEnd))
+                        throw css::lang::IllegalArgumentException();
                     std::advance(itGrpEnd, xCurGrp->mnLength);
                     for (++it; it != itGrpEnd; ++it)
                     {