sw/source/core/undo/undel.cxx | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)
New commits:
commit e1c125f6027970710eaa27bfe3d39476060878ca
Author: Patrick Luby <plub...@libreoffice.org>
AuthorDate: Sat Jan 13 19:40:37 2024 -0500
Commit: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
CommitDate: Thu Feb 8 13:30:44 2024 +0100
tdf#158740 fix crash by checking the end node's index
I don't know why m_nEndNode is larger than the size of the node
array, but adjusting m_nEndNode to the last element in the node
array stops the crashing.
Change-Id: I425589457c6729b6689a7046f063154a2496e811
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162035
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
(cherry picked from commit 9bfd8e69385930d8f558c767f7b29149324d1b70)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162211
Reviewed-by: Patrick Luby <guibomac...@gmail.com>
Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>
diff --git a/sw/source/core/undo/undel.cxx b/sw/source/core/undo/undel.cxx
index 4c199c8ac321..7661b5951740 100644
--- a/sw/source/core/undo/undel.cxx
+++ b/sw/source/core/undo/undel.cxx
@@ -1152,14 +1152,25 @@ void SwUndoDelete::UndoImpl(::sw::UndoRedoContext &
rContext)
SwNode& start(*rDoc.GetNodes()[m_nSttNode +
((m_bDelFullPara || !rDoc.GetNodes()[m_nSttNode]->IsTextNode() ||
pInsNd)
? 0 : 1)]);
- // don't include end node in the range: it may have been merged already
- // by the start node, or it may be merged by one of the moved nodes,
- // but if it isn't merged, its current frame(s) should be good...
- SwNode& end(*rDoc.GetNodes()[ m_bDelFullPara
- ? delFullParaEndNode
- // tdf#147310 SwDoc::DeleteRowCol() may delete whole table - end
must be node following table!
- : (m_nEndNode + (rDoc.GetNodes()[m_nSttNode]->IsTableNode() &&
rDoc.GetNodes()[m_nEndNode]->IsEndNode() ? 1 : 0))]);
- ::MakeFrames(&rDoc, start, end);
+ // tdf#158740 fix crash by checking the end node's index
+ // I don't know why m_nEndNode is larger than the size of the node
+ // array, but adjusting m_nEndNode to the last element in the node
+ // array stops the crashing.
+ SwNodeOffset nCount(rDoc.GetNodes().Count());
+ if (nCount > SwNodeOffset(0))
+ {
+ if (m_nEndNode > nCount - 1)
+ m_nEndNode = nCount - 1;
+
+ // don't include end node in the range: it may have been merged
already
+ // by the start node, or it may be merged by one of the moved
nodes,
+ // but if it isn't merged, its current frame(s) should be good...
+ SwNode& end(*rDoc.GetNodes()[ m_bDelFullPara
+ ? delFullParaEndNode
+ // tdf#147310 SwDoc::DeleteRowCol() may delete whole table -
end must be node following table!
+ : (m_nEndNode + (rDoc.GetNodes()[m_nSttNode]->IsTableNode() &&
rDoc.GetNodes()[m_nEndNode]->IsEndNode() ? 1 : 0))]);
+ ::MakeFrames(&rDoc, start, end);
+ }
}
if (pMovedNode)
