winaccessibility/source/UAccCOM/MAccessible.cxx | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
New commits:
commit a3773ad48a87fdbe3543e8005483e913068498b9
Author: Michael Weghorn <m.wegh...@posteo.de>
AuthorDate: Mon Feb 10 17:17:39 2025 +0100
Commit: Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Feb 11 16:15:49 2025 +0100
tdf#153131 wina11y: Return error code when child count exceeds max long
When the accessible child count exceeds max long,
no longer return max long in the IAccessible::get_accChildCount [1]
implementation in the Windows a11y bridge, but instead return error
code `S_FALSE` [2]:
> The method succeeded in part. This happens when the method succeeds, but
> the requested information is not available. For example, Microsoft
> Active Accessibility returns S_FALSE if you call IAccessible::accHitTest
> to retrieve a child object at a given point, and the specified point is
> not within the object or the object's child.
This prevents the problem that Windows Speech Recognition on Windows 10
(see tdf#153131) and apparently some tools on Windows 11 that query
information from LO via the accessibility API (see tdf#165131 and
tickets referenced from there) apparently try to iterate over all
children from child index 0 to (excluding) the returned index
unconditionally, which causes a freeze if the returned number is too large.
In practice, this is known to be a problem with Calc sheets, for which
all cells are currently considered direct children.
A quick test with NVDA and this change in place didn't reveal any
issues.
(Independent of this change, using JAWS 2025.2412.50 instantly
results in a crash somewhere in the AT code that gets run
in-process, preventing to test what implications this change
would have there otherwise.)
[1]
https://learn.microsoft.com/en-us/windows/win32/api/oleacc/nf-oleacc-iaccessible-get_accchildcount
[2] https://learn.microsoft.com/en-us/windows/win32/winauto/return-values
Change-Id: If12dbcbb387a765bec4194d2bfe61bd29aa0f8a7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/181370
Tested-by: Jenkins
Reviewed-by: Michael Weghorn <m.wegh...@posteo.de>
(cherry picked from commit 9ee01d58771b8ea585698094019b1a4dd38e54eb)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/181379
Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
diff --git a/winaccessibility/source/UAccCOM/MAccessible.cxx
b/winaccessibility/source/UAccCOM/MAccessible.cxx
index fb13e7e6878a..a6454f3c39f8 100644
--- a/winaccessibility/source/UAccCOM/MAccessible.cxx
+++ b/winaccessibility/source/UAccCOM/MAccessible.cxx
@@ -299,9 +299,13 @@ COM_DECLSPEC_NOTHROW STDMETHODIMP
CMAccessible::get_accChildCount(long *pcountCh
sal_Int64 nChildCount = pRContext->getAccessibleChildCount();
if (nChildCount > std::numeric_limits<long>::max())
{
- SAL_WARN("iacc2", "CMAccessible::get_accChildCount: Child
count exceeds maximum long value, "
- "returning max long.");
- nChildCount = std::numeric_limits<long>::max();
+ // return error code if child count exceeds max long value
+ // (for Calc sheets which report all cells as children);
+ // tdf#153131: Windows Speech Recognition and apparently some
other
+ // tools quering information via the a11y API seem to query
all children unconditionally,
+ // so returning a large number (like
std::numeric_limits<long>::max) would cause a freeze
+ SAL_WARN("iacc2", "CMAccessible::get_accChildCount: Child
count exceeds maximum long value");
+ return S_FALSE;
}
*pcountChildren = nChildCount;
