From 17467f5956a13c5fcee27507ea60d15cdda473ed Mon Sep 17 00:00:00 2001
From: =?utf8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Fri, 29 Mar 2024 19:53:17 +0000
Subject: [PATCH] ofz#67708 ignore oversized colspans

that can't fit in SCCOL

ignore negative colspan and rowspans too

Change-Id: I79a010bcd7d9d84de70f6dac2e09614d6d448227
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165481
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
---
 sc/source/filter/html/htmlpars.cxx | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/sc/source/filter/html/htmlpars.cxx b/sc/source/filter/html/htmlpars.cxx
index 72487ec8b66e..c90cc1be4ad7 100644
--- a/sc/source/filter/html/htmlpars.cxx
+++ b/sc/source/filter/html/htmlpars.cxx
@@ -1041,12 +1041,20 @@ void ScHTMLLayoutParser::TableDataOn( HtmlImportInfo* pInfo )
         {
             case HtmlOptionId::COLSPAN:
             {
-                mxActEntry->nColOverlap = static_cast<SCCOL>(rOption.GetString().toInt32());
+                sal_Int32 nColOverlap = rOption.GetString().toInt32();
+                if (nColOverlap >= 0 && nColOverlap <= SCCOL_MAX)
+                    mxActEntry->nColOverlap = static_cast<SCCOL>(nColOverlap);
+                else
+                    SAL_WARN("sc", "ScHTMLLayoutParser::TableDataOn ignoring colspan: " << nColOverlap);
             }
             break;
             case HtmlOptionId::ROWSPAN:
             {
-                mxActEntry->nRowOverlap = static_cast<SCROW>(rOption.GetString().toInt32());
+                sal_Int32 nRowOverlap = rOption.GetString().toInt32();
+                if (nRowOverlap >= 0)
+                    mxActEntry->nRowOverlap = static_cast<SCROW>(nRowOverlap);
+                else
+                    SAL_WARN("sc", "ScHTMLLayoutParser::TableDataOn ignoring rowspan: " << nRowOverlap);
             }
             break;
             case HtmlOptionId::ALIGN:
-- 
2.11.4.GIT