sc/source/core/data/formulacell.cxx                     |    4 ++--
 sc/source/core/data/grouptokenconverter.cxx             |    4 ++--
 sw/source/core/doc/DocumentContentOperationsManager.cxx |    6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

New commits:
commit 4aae5b2c3ce8b66748f742a93eba5582225a3536
Author:     Caolán McNamara <[email protected]>
AuthorDate: Sat Nov 9 21:15:48 2024 +0000
Commit:     Caolán McNamara <[email protected]>
CommitDate: Sun Nov 10 12:51:11 2024 +0100

    rRedlTable is rDoc.getIDocumentRedlineAccess().GetRedlineTable()
    
    so make this less confusing
    
    Change-Id: Icc4d4c43f0d35963bb71cdcd64bdd78b00ed9632
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176324
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/sw/source/core/doc/DocumentContentOperationsManager.cxx 
b/sw/source/core/doc/DocumentContentOperationsManager.cxx
index aae03e30cec9..269a3d67e871 100644
--- a/sw/source/core/doc/DocumentContentOperationsManager.cxx
+++ b/sw/source/core/doc/DocumentContentOperationsManager.cxx
@@ -893,17 +893,17 @@ namespace
     void lcl_SaveRedlines(const SwNodeRange& rRg, SaveRedlines_t& rArr)
     {
         SwDoc& rDoc = rRg.aStart.GetNode().GetDoc();
+        SwRedlineTable& rRedlTable = 
rDoc.getIDocumentRedlineAccess().GetRedlineTable();
         SwRedlineTable::size_type nRedlPos;
         SwPosition aSrchPos( rRg.aStart );
         aSrchPos.Adjust(SwNodeOffset(-1));
         if( rDoc.getIDocumentRedlineAccess().GetRedline( aSrchPos, &nRedlPos ) 
&& nRedlPos )
             --nRedlPos;
-        else if( nRedlPos >= 
rDoc.getIDocumentRedlineAccess().GetRedlineTable().size() )
+        else if( nRedlPos >= rRedlTable.size() )
             return ;
 
         RedlineFlags eOld = rDoc.getIDocumentRedlineAccess().GetRedlineFlags();
         rDoc.getIDocumentRedlineAccess().SetRedlineFlags_intern( ( eOld & 
~RedlineFlags::Ignore) | RedlineFlags::On );
-        SwRedlineTable& rRedlTable = 
rDoc.getIDocumentRedlineAccess().GetRedlineTable();
 
         for (;;)
         {
@@ -958,7 +958,7 @@ namespace
             else
                 break;
 
-            if (nRedlPos >= 
rDoc.getIDocumentRedlineAccess().GetRedlineTable().size())
+            if (nRedlPos >= rRedlTable.size())
                 break;
             ++nRedlPos;
         }
commit bc173a20abbdcd03bc5c0f5dbf0b2631e53c141d
Author:     Caolán McNamara <[email protected]>
AuthorDate: Fri Nov 8 17:34:42 2024 +0000
Commit:     Caolán McNamara <[email protected]>
CommitDate: Sun Nov 10 12:50:59 2024 +0100

    cid#1607160 Overflowed return value
    
    and
    
    cid#1606794 Overflowed return value
    
    Change-Id: I222f5fa18ed26ee92d970c744682bf21147265ea
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176313
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/sc/source/core/data/formulacell.cxx 
b/sc/source/core/data/formulacell.cxx
index 80abda16f2ca..832c0db8843c 100644
--- a/sc/source/core/data/formulacell.cxx
+++ b/sc/source/core/data/formulacell.cxx
@@ -4420,10 +4420,10 @@ struct ScDependantsCalculator
             // This can end up negative! Was that the original intent, or
             // is it accidental? Was it not like that originally but the
             // surrounding conditions changed?
-            nRowLen = nLastRow - nRow + 1;
+            const bool bFail = o3tl::checked_sub(nLastRow + 1, nRow, nRowLen);
             // Anyway, let's assume it doesn't make sense to return a
             // negative or zero value here.
-            if (nRowLen <= 0)
+            if (bFail || nRowLen <= 0)
                 nRowLen = 1;
         }
         else if (nLastRow == 0)
diff --git a/sc/source/core/data/grouptokenconverter.cxx 
b/sc/source/core/data/grouptokenconverter.cxx
index 4d427fc32bab..18b2807515ee 100644
--- a/sc/source/core/data/grouptokenconverter.cxx
+++ b/sc/source/core/data/grouptokenconverter.cxx
@@ -70,13 +70,13 @@ SCROW ScGroupTokenConverter::trimLength(SCTAB nTab, SCCOL 
nCol1, SCCOL nCol2, SC
         // This can end up negative! Was that the original intent, or
         // is it accidental? Was it not like that originally but the
         // surrounding conditions changed?
-        nRowLen = nLastRow - nRow + 1;
+        const bool bFail = o3tl::checked_sub(nLastRow + 1, nRow, nRowLen);
         // Anyway, let's assume it doesn't make sense to return a
         // negative value here. But should we then return 0 or 1? In
         // the "Column is empty" case below, we return 1, why!? And,
         // at the callsites there are tests for a zero value returned
         // from this function (but not for a negative one).
-        if (nRowLen < 0)
+        if (bFail || nRowLen < 0)
             nRowLen = 0;
     }
     else if (nLastRow == 0)

Reply via email to