[Libreoffice-commits] core.git: Branch 'libreoffice-7-0' - lotuswordpro/source

[Caolán McNamara (via logerrit)]

 lotuswordpro/source/filter/lwprowlayout.cxx |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit 37d818a65429cde5b3eb6c5a1a95012894d039d7
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Jun 11 09:31:44 2020 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Jun 11 12:53:02 2020 +0200

    ofz#23300 infinite loop
    
    Change-Id: I0ee67e8efefa48942357340cae46bd7ece27e5b7
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96098
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/lotuswordpro/source/filter/lwprowlayout.cxx b/lotuswordpro/source/filter/lwprowlayout.cxx
index 56ea0c98ce33..cb350f891fa1 100644
--- a/lotuswordpro/source/filter/lwprowlayout.cxx
+++ b/lotuswordpro/source/filter/lwprowlayout.cxx
@@ -406,7 +406,10 @@ void LwpRowLayout::ConvertCommonRow(rtl::Reference<XFTable> const & pXFTable, sa
                     auto nNumCols = pConnCell->GetNumcols();
                     if (!nNumCols)
                         throw std::runtime_error("loop in conversion");
-                    nCellEndCol = i + nNumCols - 1;
+                    auto nNewEndCol = i + nNumCols - 1;
+                    if (nNewEndCol > std::numeric_limits<sal_uInt8>::max())
+                        throw std::range_error("column index too large");
+                    nCellEndCol = nNewEndCol;
                     i = nCellEndCol;
                 }
                 xCell = pCellLayout->DoConvertCell(pTable->GetObjectID(),crowid,i);