On Fri, May 18, 2012 at 9:14 AM, Noel Power <nopower@suse.com> wrote:
http://cgit.freedesktop.org/libreoffice/core/commit/?id=8b1d29bc9b00bc2730738a990023a65ab6e0219b & http://cgit.freedesktop.org/libreoffice/core/commit/?id=abb26f51eea0399754cc8f5b7d7a7d648d68f630I took it that it should work how I outlined above and committed a further fix which should safeguard against illegal access, please additionally consider http://cgit.freedesktop.org/libreoffice/core/commit/?id=8352eb5a1af1eb44550a9d60d31e6c2fb2dc43b9
So, these extra range checks should be safe; however.... The original intention of *not* checking the bound of the tab index was that we assumed that this list would be in sync with the maTab in ScDocument at all times. So, if they are out of sync then something else may be causing this problem... Let me ping Markus here. He worked on the rework of ScTable storage, and this issue is related to that work. Kohei