commit c54b0146594f0d1fe8070c4228e5c02eb27dfed5
author Caolán McNamara <caolanm@redhat.com> Thu Feb 27 09:17:11 2020 +0000
committer Adolfo Jayme Barrientos <fitojb@ubuntu.com> Wed Jun 24 12:38:37 2020 +0200
tree f2a303e1d6f1fbf7b41ac7d469b80573afdaf1e1
parent 1532a477553ef87dd34693fad50028d6813d5007

tdf#134019: ofz#20904 check bounds

Change-Id: I5d6d381ebd359b233b309e08131f3dda21310d80
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/89620
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 8e3a29110c8ad739bedeea90932663608d8d3935)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96573
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
(cherry picked from commit 74def786fe5c20c5415060209e56ee30cde8e266)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96577
Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
Tested-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>

sc/qa/unit/data/xls/pass/ofz20904-1.xls

diff --git a/sc/qa/unit/data/xls/pass/ofz20904-1.xls b/sc/qa/unit/data/xls/pass/ofz20904-1.xls
new file mode 100644
index 0000000..44dbe8f
--- /dev/null
+++ b/sc/qa/unit/data/xls/pass/ofz20904-1.xls
Binary files differ

sc/source/core/data/dociter.cxx

diff --git a/sc/source/core/data/dociter.cxx b/sc/source/core/data/dociter.cxx
index f501bb8..5331e8a 100644
--- a/sc/source/core/data/dociter.cxx
+++ b/sc/source/core/data/dociter.cxx
@@ -892,14 +892,17 @@
    if (maStartPos.Tab() > maEndPos.Tab())
        maStartPos.SetTab(maEndPos.Tab());

    maCurPos = maStartPos;

    if (!mpDoc->maTabs[maCurPos.Tab()])
    if (!mpDoc->maTabs[maStartPos.Tab()])
    {
        OSL_FAIL("Table not found");
        maStartPos = ScAddress(mpDoc->MaxCol()+1, mpDoc->MaxRow()+1, MAXTAB+1); // -> Abort on GetFirst.
        maCurPos = maStartPos;
    }
    else
    {
        maStartPos.SetCol(mpDoc->maTabs[maStartPos.Tab()]->ClampToAllocatedColumns(maStartPos.Col()));
    }

    maCurPos = maStartPos;
}

bool ScCellIterator::getCurrent()