This is an automated email from the ASF dual-hosted git repository. jimjag pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit 54f4a4d6d7394a4f3dff13b00d4500d2208a39aa Author: Jim Jagielski <[email protected]> AuthorDate: Mon Aug 3 13:00:59 2026 -0400 Fix stale block index in BigPtrArray::Remove after deleting the last block --- main/sw/source/core/bastyp/bparr.cxx | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/main/sw/source/core/bastyp/bparr.cxx b/main/sw/source/core/bastyp/bparr.cxx index 7035e53f2f..a7ecb56364 100644 --- a/main/sw/source/core/bastyp/bparr.cxx +++ b/main/sw/source/core/bastyp/bparr.cxx @@ -437,6 +437,15 @@ void BigPtrArray::Remove( sal_uLong pos, sal_uLong n ) --nBlk1; } BlockDel( nBlkdel ); // es wurden Bloecke geloescht + + // If the deleted block(s) reached the very end of the array, the + // branch above (which backs nBlk1 up to the block before the gap) + // never runs, so nBlk1 can be left one-or-more past the now- + // shrunk nBlock. ppInf[nBlk1] is then stale/uninitialized, and + // both UpdIndex() and the nCur cache below dereference it via + // that index. Clamp to the last real block, or 0 if now empty. + if( nBlk1 >= nBlock ) + nBlk1 = nBlock ? nBlock - 1 : 0; } nSize -= n;
