Check both lower and upper bound for tainted loop limit

[features.git] / src / mathed / MathParser.cpp

diff --git a/src/mathed/MathParser.cpp b/src/mathed/MathParser.cpp
index 9bc5ff9362bbd8514eec8b83610ef2c9bcc05abb..6c04d625af8466eca9ded12a2da00e724a08b90a 100644 (file)
--- a/src/mathed/MathParser.cpp
+++ b/src/mathed/MathParser.cpp
@@ -1375,7 +1375,7 @@ bool Parser::parse1(InsetMathGrid & grid, unsigned flags,
                        parse(count, FLAG_ITEM, mode);
                        int cols;
                        // limit arbitrarily to 100 columns
-                       if (extractNumber(count, cols) && cols < 100) {
+                       if (extractNumber(count, cols) && cols > 0 && cols < 100) {
                                // resize the table if necessary
                                size_t first = grid.index(cellrow, cellcol);
                                for (int i = 1; i < cols; ++i) {