From a18ee6498d958ec957b27af4b65959e1b001f61d Mon Sep 17 00:00:00 2001
From: John McNamara <jmcnamara@cpan.org>
Date: Tue, 11 Feb 2025 10:26:22 +0000
Subject: [PATCH] worksheet: fix buffer overflow in table formula expansion

---
 src/worksheet.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/worksheet.c b/src/worksheet.c
index 6f63a68e..a106c5d9 100644
--- a/src/worksheet.c
+++ b/src/worksheet.c
@@ -1717,9 +1717,11 @@ _expand_table_formula(const char *formula)
 
     ptr = formula;
 
-    while (*ptr++) {
+    while (*ptr) {
         if (*ptr == '@')
             ref_count++;
+
+        ptr++;
     }
 
     if (ref_count == 0) {