[Libreoffice-commits] core.git: Branch 'libreoffice-6-1' - sc/source

[Libreoffice Gerrit user]

 sc/source/core/data/column3.cxx |    2 ++
 1 file changed, 2 insertions(+)

New commits:
commit 26300f5d4c4e6241baf8cadcfea094e7969814a5
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 08:55:23 2018 +0100
Commit:     Markus Mohrhard <markus.mohrhard at googlemail.com>
CommitDate: Fri Aug 3 18:32:20 2018 +0200

    forcepoint#55 invalid iterator increment
    
    Change-Id: I151602f645a48404d93e0ae64a9e1d2a6ba2bc4b
    Reviewed-on: https://gerrit.libreoffice.org/58386
    Tested-by: Jenkins
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 0ad5117d7d10..7b760b3daa48 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -3080,6 +3080,8 @@ public:
                 if (xCurGrp)
                 {
                     // Move to the cell after the last cell of the current group.
+                    if (xCurGrp->mnLength > std::distance(it, itEnd))
+                        throw css::lang::IllegalArgumentException();
                     std::advance(it, xCurGrp->mnLength);
                     nRow += xCurGrp->mnLength;
                 }