sd/source/filter/eppt/epptbase.hxx           |    3 ++-
 sd/source/filter/eppt/epptooxml.hxx          |    2 +-
 sd/source/filter/eppt/pptx-epptooxml.cxx     |    2 +-
 svtools/source/control/tabbar.cxx            |   11 ++++-------
 sw/source/core/access/AccessibilityCheck.cxx |   20 +++++++++++++-------
 5 files changed, 21 insertions(+), 17 deletions(-)

New commits:
commit 255a0032d399ae13e0f166942c03721caa1e0d74
Author:     Balazs Varga <balazs.varga.ext...@allotropia.de>
AuthorDate: Fri Dec 22 13:55:42 2023 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Dec 26 09:31:34 2023 +0100

    cid#1559857 Illegal address computation
    
    Follow up of commit: bff76421e234df7246a7f49c71a11432f86e09d1
    
    Change-Id: I1abfcea1c7ca8e55f8a4b19b66d80b901f575bcf
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161179
    Tested-by: Jenkins
    Tested-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit c5cc7af60d4b93d4247fd88f941a323f4a56dfcd)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161222
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sd/source/filter/eppt/epptbase.hxx 
b/sd/source/filter/eppt/epptbase.hxx
index 64709fa14f39..70bcd3a4b6ce 100644
--- a/sd/source/filter/eppt/epptbase.hxx
+++ b/sd/source/filter/eppt/epptbase.hxx
@@ -73,7 +73,8 @@ enum class EppLayout
     TITLERIGHT2BODIESLEFT = 18  /* Vertical title on the right, body on the 
left split into 2 rows                        */
 };
 
-#define EPP_LAYOUT_SIZE 36
+#define EPP_LAYOUT_SIZE 25
+#define OOXML_LAYOUT_SIZE 36
 
 struct PHLayout
 {
diff --git a/sd/source/filter/eppt/epptooxml.hxx 
b/sd/source/filter/eppt/epptooxml.hxx
index 2d67ebce2c77..d9d65a2e8300 100644
--- a/sd/source/filter/eppt/epptooxml.hxx
+++ b/sd/source/filter/eppt/epptooxml.hxx
@@ -139,7 +139,7 @@ private:
 
     ::sax_fastparser::FSHelperPtr mPresentationFS;
 
-    LayoutInfo mLayoutInfo[EPP_LAYOUT_SIZE];
+    LayoutInfo mLayoutInfo[OOXML_LAYOUT_SIZE];
     std::vector< ::sax_fastparser::FSHelperPtr > mpSlidesFSArray;
     sal_Int32 mnLayoutFileIdMax;
 
diff --git a/sd/source/filter/eppt/pptx-epptooxml.cxx 
b/sd/source/filter/eppt/pptx-epptooxml.cxx
index 5986ed958380..0967b6a3b34e 100644
--- a/sd/source/filter/eppt/pptx-epptooxml.cxx
+++ b/sd/source/filter/eppt/pptx-epptooxml.cxx
@@ -196,7 +196,7 @@ struct PPTXLayoutInfo
 
 }
 
-const PPTXLayoutInfo aLayoutInfo[EPP_LAYOUT_SIZE] =
+const PPTXLayoutInfo aLayoutInfo[OOXML_LAYOUT_SIZE] =
 {
     { 0, "Title Slide", "title" },
     { 1, "Title and text", "tx" },
commit 7c10c49309acb2f183ef726283e36044d8f68766
Author:     Andreas Heinisch <andreas.heini...@yahoo.de>
AuthorDate: Thu Dec 21 20:33:20 2023 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Dec 26 09:31:30 2023 +0100

    Revert "tdf#100584 - Arrange sheets in the tab bar depending on the RTL 
settings"
    
    This reverts commit be86c8f2432623fdb8ed4f22ca08c35121fd8bec.
    
    Reason for revert: To many regressions.
    
    Change-Id: Id3fb8dc5d4edb84c0008b7834a80887aaa7d9f83
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161154
    Tested-by: Andreas Heinisch <andreas.heini...@yahoo.de>
    Reviewed-by: Andreas Heinisch <andreas.heini...@yahoo.de>
    (cherry picked from commit 3430a2c639a9f714259f9d319515464a653d21ab)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161159
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit b3e86695022f8db57344f4115ee360072d671838)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161212

diff --git a/svtools/source/control/tabbar.cxx 
b/svtools/source/control/tabbar.cxx
index 1690269ba234..f9faa2bbe0dc 100644
--- a/svtools/source/control/tabbar.cxx
+++ b/svtools/source/control/tabbar.cxx
@@ -710,15 +710,10 @@ void TabBar::ImplFormat()
     if (!mbFormat)
         return;
 
+    sal_uInt16 nItemIndex = 0;
     tools::Long x = mnOffX;
-
-    const size_t nItemListSize = mpImpl->maItemList.size();
-    for (size_t nItemIndex = 0; nItemIndex < nItemListSize; nItemIndex++)
+    for (auto & rItem : mpImpl->maItemList)
     {
-        // tdf#100584 - arrange sheets depending on the RTL settings
-        auto& rItem = mbMirrored ? mpImpl->maItemList[nItemListSize - 
nItemIndex - 1]
-                                 : mpImpl->maItemList[nItemIndex];
-
         // At all non-visible tabs an empty rectangle is set
         if ((nItemIndex + 1 < mnFirstPos) || (x > mnLastOffX))
             rItem.maRect.SetEmpty();
@@ -746,6 +741,8 @@ void TabBar::ImplFormat()
                 rItem.maRect.SetLeft(nNewLeft);
             }
         }
+
+        nItemIndex++;
     }
 
     mbFormat = false;
commit f118426560d913f5180aab2a8ef6424e8825a778
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Fri Dec 22 10:38:52 2023 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Dec 26 09:31:25 2023 +0100

    sw: fix another null deref in a11y check
    
    similar to
    
    author  Caolán McNamara <caolan.mcnam...@collabora.com> 2023-12-21 16:47:18 
+0000
    committer       Caolán McNamara <caolan.mcnam...@collabora.com> 2023-12-21 
21:15:03 +0100
    commit  ba712e9a35179c480cdc6f9d600d79040a273d53 (patch)
    tree    88e237265eb6ce884d2807b4c178a761d4c73956
    parent  8cd01e5278b2be25a1186139e431591a85a5080f (diff)
    crashreporting: apparent null deref in a11y check
    
    Change-Id: I3fb6a916fcbcce4b599a925dcc7d39a12e60a972
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161149
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit ca4aa82e2a0a97a63f51820247aa4e59e645992a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161166
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161192

diff --git a/sw/source/core/access/AccessibilityCheck.cxx 
b/sw/source/core/access/AccessibilityCheck.cxx
index 912a397ccb4c..42f4cf7303c9 100644
--- a/sw/source/core/access/AccessibilityCheck.cxx
+++ b/sw/source/core/access/AccessibilityCheck.cxx
@@ -124,7 +124,7 @@ class NoTextNodeAltTextCheck : public NodeCheck
                                           
sfx::AccessibilityIssueID::NO_ALT_GRAPHIC);
                 pIssue->setDoc(pNoTextNode->GetDoc());
                 pIssue->setIssueObject(IssueObject::GRAPHIC);
-                pIssue->setObjectID(pNoTextNode->GetFlyFormat()->GetName());
+                pIssue->setObjectID(pFrameFormat->GetName());
                 pIssue->setNode(pNoTextNode);
             }
         }
@@ -1190,14 +1190,20 @@ public:
             return;
 
         // If a node is in fly and if it is not anchored as char, throw 
warning.
-        const SwNode* startFly = pCurrent->FindFlyStartNode();
-        if (startFly
-            && startFly->GetFlyFormat()->GetAnchor().GetAnchorId() != 
RndStdIds::FLY_AS_CHAR)
+        const SwNode* pStartFly = pCurrent->FindFlyStartNode();
+        if (!pStartFly)
+            return;
+
+        const SwFrameFormat* pFormat = pStartFly->GetFlyFormat();
+        if (!pFormat)
+            return;
+
+        if (pFormat->GetAnchor().GetAnchorId() != RndStdIds::FLY_AS_CHAR)
         {
             SwNodeIndex aCurrentIdx(*pCurrent);
-            SwNodeIndex aIdx(*startFly);
+            SwNodeIndex aIdx(*pStartFly);
             SwNode* pFirstTextNode = &aIdx.GetNode();
-            SwNodeOffset nEnd = startFly->EndOfSectionIndex();
+            SwNodeOffset nEnd = pStartFly->EndOfSectionIndex();
             while (aIdx < nEnd)
             {
                 if (pFirstTextNode->IsContentNode() && 
pFirstTextNode->IsTextNode())
@@ -1206,7 +1212,7 @@ public:
                     {
                         auto pIssue = lclAddIssue(m_rIssueCollection, 
SwResId(STR_FLOATING_TEXT));
                         pIssue->setIssueObject(IssueObject::TEXTFRAME);
-                        
pIssue->setObjectID(startFly->GetFlyFormat()->GetName());
+                        pIssue->setObjectID(pFormat->GetName());
                         pIssue->setDoc(pCurrent->GetDoc());
                         pIssue->setNode(pCurrent);
                     }

Reply via email to