[Libreoffice-commits] core.git: sc/qa sc/source

[Caolán McNamara]

 sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls |binary
 sc/source/core/data/column3.cxx                       |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit 6215deb5d2845e339e82108179d5a5ab91915ffd
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Mar 26 09:23:48 2018 +0100

    forcepoint #30 check validity of group range
    
    Change-Id: Ie0611f36809b051ce46030e44c137b4e1f8d2fe0
    Reviewed-on: https://gerrit.libreoffice.org/51856
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls
new file mode 100755
index 000000000000..1aca9c7f113e
Binary files /dev/null and b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls differ
diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index c5d75e70d7b0..3774086251de 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -3096,6 +3096,8 @@ public:
                     xPrevGrp->mnLength += xCurGrp->mnLength;
                     pCur->SetCellGroup(xPrevGrp);
                     sc::formula_block::iterator itGrpEnd = it;
+                    if (xCurGrp->mnLength > std::distance(itGrpEnd, itEnd))
+                        throw css::lang::IllegalArgumentException();
                     std::advance(itGrpEnd, xCurGrp->mnLength);
                     for (++it; it != itGrpEnd; ++it)
                     {