core.git: sc/source

[Caolán McNamara (via logerrit)]

 sc/source/core/tool/address.cxx |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

New commits:
commit 40f97d1cf52490e8ae1b24833af07843e47f98e8
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Aug 5 20:23:20 2024 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Tue Aug 6 09:16:12 2024 +0200

    ofz#70966 Integer-overflow
    
    Change-Id: If91c4db8e1180f6408ef72031299f0b88e3c9a64
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171510
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sc/source/core/tool/address.cxx b/sc/source/core/tool/address.cxx
index 8cd53a5a5214..a4a4fe2bfb3a 100644
--- a/sc/source/core/tool/address.cxx
+++ b/sc/source/core/tool/address.cxx
@@ -733,6 +733,9 @@ static const sal_Unicode* lcl_r1c1_get_row(
         if( isRelative )
             return nullptr;
         n = rDetails.nRow;
+
+        if (n < 0 || n >= rSheetLimits.GetMaxRowCount())
+            return nullptr;
     }
     else if( isRelative )
     {
@@ -740,15 +743,23 @@ static const sal_Unicode* lcl_r1c1_get_row(
             return nullptr;
         n += rDetails.nRow;
         pEnd++;
+
+        if (n < 0 || n >= rSheetLimits.GetMaxRowCount())
+            return nullptr;
     }
     else
     {
         *nFlags |= ScRefFlags::ROW_ABS;
+
+        if (n <= 0)
+            return nullptr;
+
         n--;
+
+        if (n >= rSheetLimits.GetMaxRowCount())
+            return nullptr;
     }
 
-    if( n < 0 || n >= rSheetLimits.GetMaxRowCount() )
-        return nullptr;
     pAddr->SetRow( static_cast<SCROW>( n ) );
     *nFlags |= ScRefFlags::ROW_VALID;