read past end of pCellInfo

Change-Id: Ic024f8dd3aaf368877f5914c6106164508760da8
Reviewed-on: https://gerrit.libreoffice.org/19752Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>
(cherry picked from commit 5ae015fc)
Reviewed-on: https://gerrit.libreoffice.org/19755

sc/source/ui/view/output.cxx

@@ -1059,7 +1059,10 @@ void ScOutputData::DrawBackground()
 
                     for (SCCOL nMerged = 0; nMerged < nMergedCells; ++nMerged)
                     {
-                        nPosX += pRowInfo[0].pCellInfo[nX+nOldMerged+nMerged].nWidth * nLayoutSign;
+                        SCCOL nCol = nX+nOldMerged+nMerged;
+                        if (nCol > nX2+2)
+                            break;
+                        nPosX += pRowInfo[0].pCellInfo[nCol].nWidth * nLayoutSign;
                     }
                 }
                 drawCells( NULL, NULL, pOldColor, pOldBackground, aRect, nPosX, nSignedOneX, mpDev, NULL, pOldDataBarInfo, NULL, pOldIconSetInfo );