[Libreoffice-commits] core.git: lotuswordpro/source

[Caolán McNamara (via logerrit)]

 lotuswordpro/source/filter/lwprowlayout.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 6e77dcd9d2605e55b57d0a379d87cdd2c48b62f4
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Jun 11 09:31:44 2020 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Jun 11 12:13:12 2020 +0200

    ofz#23300 infinite loop
    
    Change-Id: I0ee67e8efefa48942357340cae46bd7ece27e5b7
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96085
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/lotuswordpro/source/filter/lwprowlayout.cxx b/lotuswordpro/source/filter/lwprowlayout.cxx
index e21505d06420..3321f294469e 100644
--- a/lotuswordpro/source/filter/lwprowlayout.cxx
+++ b/lotuswordpro/source/filter/lwprowlayout.cxx
@@ -404,7 +404,10 @@ void LwpRowLayout::ConvertCommonRow(rtl::Reference<XFTable> const & pXFTable, sa
                     auto nNumCols = pConnCell->GetNumcols();
                     if (!nNumCols)
                         throw std::runtime_error("loop in conversion");
-                    nCellEndCol = i + nNumCols - 1;
+                    auto nNewEndCol = i + nNumCols - 1;
+                    if (nNewEndCol > std::numeric_limits<sal_uInt8>::max())
+                        throw std::range_error("column index too large");
+                    nCellEndCol = nNewEndCol;
                     i = nCellEndCol;
                 }
                 xCell = pCellLayout->DoConvertCell(pTable->GetObjectID(),crowid,i);