From 31cd421bcd26647cb7edbb694b05473271fe9153 Mon Sep 17 00:00:00 2001
From: Jean-Marc Lasgouttes <lasgouttes@lyx.org>
Date: Tue, 28 Mar 2017 11:41:27 +0200
Subject: [PATCH] Limit multirow to 100 columns in mathed

Spotted by coverity, this avoids a blocking loop when parsing.
---
 src/mathed/MathParser.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/mathed/MathParser.cpp b/src/mathed/MathParser.cpp
index ca2eb0f6e5..ace167c439 100644
--- a/src/mathed/MathParser.cpp
+++ b/src/mathed/MathParser.cpp
@@ -1374,7 +1374,8 @@ bool Parser::parse1(InsetMathGrid & grid, unsigned flags,
 			MathData count;
 			parse(count, FLAG_ITEM, mode);
 			int cols;
-			if (extractNumber(count, cols)) {
+			// limit arbitrarily to 100 columns
+			if (extractNumber(count, cols) && cols < 100) {
 				// resize the table if necessary
 				size_t first = grid.index(cellrow, cellcol);
 				for (int i = 1; i < cols; ++i) {
-- 
2.39.5