diff -ru libwpd-0.10.2/src/lib/WP6ContentListener.cpp libwpd-0.10.2.new/src/lib/WP6ContentListener.cpp

--- libwpd-0.10.2/src/lib/WP6ContentListener.cpp	2017-09-08 18:04:25.000000000 +0100

+++ libwpd-0.10.2.new/src/lib/WP6ContentListener.cpp	2018-10-30 10:54:22.326697162 +0000

@@ -1311,7 +1311,10 @@

 		m_ps->m_tableDefinition.m_columnsProperties.clear();

 		// pull a table definition off of our stack

-		m_parseState->m_currentTable = m_parseState->m_tableList[m_parseState->m_nextTableIndice++];

+		auto index = m_parseState->m_nextTableIndice++;

+		if (index >= m_parseState->m_tableList.size())

+			throw ParseException();

+		m_parseState->m_currentTable = m_parseState->m_tableList[index];

 		if (!m_parseState->m_currentTable)

 			throw ParseException();

 		m_parseState->m_currentTable->makeBordersConsistent();

diff -ru libwpd-0.10.2/src/lib/WPXTable.h libwpd-0.10.2.new/src/lib/WPXTable.h

--- libwpd-0.10.2/src/lib/WPXTable.h	2015-12-30 08:27:30.000000000 +0000

+++ libwpd-0.10.2.new/src/lib/WPXTable.h	2018-10-30 10:55:41.264362182 +0000

@@ -92,6 +92,10 @@

 	{

 		m_tableList->push_back(table);

 	}

+	size_t size() const

+	{

+		return m_tableList->size();

+	}

 private:

 	void release();