commit 74def786fe5c20c5415060209e56ee30cde8e266
author Caolán McNamara <caolanm@redhat.com> Thu Feb 27 09:17:11 2020 +0000
committer Noel Grandin <noel.grandin@collabora.co.uk> Thu Jun 18 08:54:42 2020 +0200
tree cf4955a031673221bd8f2e62ac414a088a607885
parent 1e04dd3bca5b3bd3ea94af3304bdce87b705451b

tdf#134019: ofz#20904 check bounds

Change-Id: I5d6d381ebd359b233b309e08131f3dda21310d80
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/89620
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 8e3a29110c8ad739bedeea90932663608d8d3935)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96573
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>

sc/qa/unit/data/xls/pass/ofz20904-1.xls

diff --git a/sc/qa/unit/data/xls/pass/ofz20904-1.xls b/sc/qa/unit/data/xls/pass/ofz20904-1.xls
new file mode 100644
index 0000000..44dbe8f
--- /dev/null
+++ b/sc/qa/unit/data/xls/pass/ofz20904-1.xls
Binary files differ

sc/source/core/data/dociter.cxx

diff --git a/sc/source/core/data/dociter.cxx b/sc/source/core/data/dociter.cxx
index f501bb8..5331e8a 100644
--- a/sc/source/core/data/dociter.cxx
+++ b/sc/source/core/data/dociter.cxx
@@ -892,14 +892,17 @@
    if (maStartPos.Tab() > maEndPos.Tab())
        maStartPos.SetTab(maEndPos.Tab());

    maCurPos = maStartPos;

    if (!mpDoc->maTabs[maCurPos.Tab()])
    if (!mpDoc->maTabs[maStartPos.Tab()])
    {
        OSL_FAIL("Table not found");
        maStartPos = ScAddress(mpDoc->MaxCol()+1, mpDoc->MaxRow()+1, MAXTAB+1); // -> Abort on GetFirst.
        maCurPos = maStartPos;
    }
    else
    {
        maStartPos.SetCol(mpDoc->maTabs[maStartPos.Tab()]->ClampToAllocatedColumns(maStartPos.Col()));
    }

    maCurPos = maStartPos;
}

bool ScCellIterator::getCurrent()