sw/source/core/text/itrcrsr.cxx | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
New commits:
commit 42a315b4a777dc371297752b6233e437d36c456b
Author: Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Tue Jan 23 18:23:12 2024 +0100
Commit: Michael Stahl <michael.st...@allotropia.de>
CommitDate: Thu Jan 25 11:46:22 2024 +0100
sw: fix crash in SwTextCursor::GetModelPositionForViewPoint()
With a field that spans 3 SwTextFrames, it happens that
rText[sal_Int32(nCurrStart + nLength) - 1]
results in rText[-1]; it looks like both nCurrStart and nLength are
correct (nCurrStart was decremented in line 1531 after "if (bFieldInfo)")
so there is a missing check here.
Change-Id: I0d5be617e8e54c20dc8633efd3a7d82510f4acd7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162522
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
diff --git a/sw/source/core/text/itrcrsr.cxx b/sw/source/core/text/itrcrsr.cxx
index 0cb12bf54a21..ea399a66f5d9 100644
--- a/sw/source/core/text/itrcrsr.cxx
+++ b/sw/source/core/text/itrcrsr.cxx
@@ -1621,8 +1621,11 @@ TextFrameIndex
SwTextCursor::GetModelPositionForViewPoint( SwPosition *pPos, con
// Skip space at the end of the line
if( bLastPortion && (m_pCurr->GetNext() || m_pFrame->GetFollow() )
- && rText[sal_Int32(nCurrStart + nLength) - 1] == ' ' )
+ && sal_Int32(nLength) != 0
+ && rText[sal_Int32(nCurrStart + nLength) - 1] == ' ')
+ {
--nLength;
+ }
if( nWidth > nX ||
( nWidth == nX && pPor->IsMultiPortion() &&
static_cast<SwMultiPortion*>(pPor)->IsDouble() ) )
