97cfee
diff -ru libwpd-0.10.2/src/lib/WP6ContentListener.cpp libwpd-0.10.2.new/src/lib/WP6ContentListener.cpp
97cfee
--- libwpd-0.10.2/src/lib/WP6ContentListener.cpp	2017-09-08 18:04:25.000000000 +0100
97cfee
+++ libwpd-0.10.2.new/src/lib/WP6ContentListener.cpp	2018-10-30 10:54:22.326697162 +0000
97cfee
@@ -1311,7 +1311,10 @@
97cfee
 		m_ps->m_tableDefinition.m_columnsProperties.clear();
97cfee
 
97cfee
 		// pull a table definition off of our stack
97cfee
-		m_parseState->m_currentTable = m_parseState->m_tableList[m_parseState->m_nextTableIndice++];
97cfee
+		auto index = m_parseState->m_nextTableIndice++;
97cfee
+		if (index >= m_parseState->m_tableList.size())
97cfee
+			throw ParseException();
97cfee
+		m_parseState->m_currentTable = m_parseState->m_tableList[index];
97cfee
 		if (!m_parseState->m_currentTable)
97cfee
 			throw ParseException();
97cfee
 		m_parseState->m_currentTable->makeBordersConsistent();
97cfee
diff -ru libwpd-0.10.2/src/lib/WPXTable.h libwpd-0.10.2.new/src/lib/WPXTable.h
97cfee
--- libwpd-0.10.2/src/lib/WPXTable.h	2015-12-30 08:27:30.000000000 +0000
97cfee
+++ libwpd-0.10.2.new/src/lib/WPXTable.h	2018-10-30 10:55:41.264362182 +0000
97cfee
@@ -92,6 +92,10 @@
97cfee
 	{
97cfee
 		m_tableList->push_back(table);
97cfee
 	}
97cfee
+	size_t size() const
97cfee
+	{
97cfee
+		return m_tableList->size();
97cfee
+	}
97cfee
 
97cfee
 private:
97cfee
 	void release();