read past end of pCellInfo

Change-Id: Ic024f8dd3aaf368877f5914c6106164508760da8
Reviewed-on: https://gerrit.libreoffice.org/19752Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Eike Rathke <erack@redhat.com>

sc/source/ui/view/output.cxx

@@ -1100,7 +1100,10 @@ void ScOutputData::DrawBackground(vcl::RenderContext& rRenderContext)
 
                     for (SCCOL nMerged = 0; nMerged < nMergedCells; ++nMerged)
                     {
-                        nPosX += pRowInfo[0].pCellInfo[nX+nOldMerged+nMerged].nWidth * nLayoutSign;
+                        SCCOL nCol = nX+nOldMerged+nMerged;
+                        if (nCol > nX2+2)
+                            break;
+                        nPosX += pRowInfo[0].pCellInfo[nCol].nWidth * nLayoutSign;
                     }
                 }