From 113fcf70dc9d5df00073a057340f90b55c8dafdb Mon Sep 17 00:00:00 2001
From: Andras Timar <andras.timar@collabora.com>
Date: Thu, 5 Mar 2026 14:04:27 +0100
Subject: [PATCH] fix crash in CreateB2DPrimitiveRange due to out-of-bounds
 array access

Add bounds validation in CreateB2DPrimitiveRange to bail out when
row/column indices exceed the array dimensions. Guard against size_t
underflow in DrawFrame when the frame array has fewer than 3 rows or
columns.

Change-Id: I0f3a7b8c2d1e4f6a9b0c3d5e7f8a1b2c4d6e8f0a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201030
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
(cherry picked from commit dbcd8f2d20ef5bf29bcbec0649589401f2bdc503)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/204886
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
---
 sc/source/ui/view/output.cxx         |  7 +++++++
 svx/source/dialog/framelinkarray.cxx | 11 +++++++++++
 2 files changed, 18 insertions(+)

diff --git a/sc/source/ui/view/output.cxx b/sc/source/ui/view/output.cxx
index 15b273d7a7df..d60f471970ac 100644
--- a/sc/source/ui/view/output.cxx
+++ b/sc/source/ui/view/output.cxx
@@ -1543,6 +1543,13 @@ void ScOutputData::DrawFrame(vcl::RenderContext& rRenderContext)
 
     // *** draw the array ***
 
+    if (nColCount < 3 || nRowCount < 3)
+    {
+        SAL_WARN("sc.ui", "DrawFrame: unexpected array size:"
+            " nColCount=" << nColCount << " nRowCount=" << nRowCount);
+        return;
+    }
+
     size_t nFirstCol = 1;
     size_t nFirstRow = 1;
     size_t nLastCol = nColCount - 2;
diff --git a/svx/source/dialog/framelinkarray.cxx b/svx/source/dialog/framelinkarray.cxx
index 833d2474aa82..4ec66f8b1413 100644
--- a/svx/source/dialog/framelinkarray.cxx
+++ b/svx/source/dialog/framelinkarray.cxx
@@ -24,6 +24,7 @@
 #include <unordered_set>
 #include <algorithm>
 #include <o3tl/hash_combine.hxx>
+#include <sal/log.hxx>
 #include <tools/debug.hxx>
 #include <tools/gen.hxx>
 #include <vcl/canvastools.hxx>
@@ -1407,6 +1408,16 @@ drawinglayer::primitive2d::Primitive2DContainer Array::CreateB2DPrimitiveRange(
     DBG_FRAME_CHECK_COLROW( nFirstCol, nFirstRow, "CreateB2DPrimitiveRange" );
     DBG_FRAME_CHECK_COLROW( nLastCol, nLastRow, "CreateB2DPrimitiveRange" );
 
+    // Bail out if indices are out of range
+    if (nFirstCol < 0 || nFirstRow < 0 || nLastCol >= GetColCount() || nLastRow >= GetRowCount())
+    {
+        SAL_WARN("svx.dialog", "CreateB2DPrimitiveRange indices out of range: "
+            "nFirstCol=" << nFirstCol << " nFirstRow=" << nFirstRow
+            << " nLastCol=" << nLastCol << " nLastRow=" << nLastRow
+            << " ColCount=" << GetColCount() << " RowCount=" << GetRowCount());
+        return drawinglayer::primitive2d::Primitive2DContainer();
+    }
+
 #ifdef OPTICAL_CHECK_CLIPRANGE_FOR_MERGED_CELL
     std::vector<basegfx::B2DRange> aClipRanges;
 #endif