sw/source/core/doc/extinput.cxx | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
New commits: commit 2d32f9abd43e9308ebc14c9f12fa7440f1cc1654 Author: Jonathan Clark <[email protected]> AuthorDate: Tue Oct 28 09:16:42 2025 -0600 Commit: Jonathan Clark <[email protected]> CommitDate: Tue Oct 28 18:07:51 2025 +0100 tdf#148991 sw: fix string corruption after IME dismiss Fixes an out-of-bounds substring copy when dismissing an IME in overwrite mode when the candidate text is longer than the original paragraph. Change-Id: I09032225f3a6d85043cc4c6fa5f2b1bfeafc3755 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/193103 Tested-by: Jenkins Reviewed-by: Jonathan Clark <[email protected]> diff --git a/sw/source/core/doc/extinput.cxx b/sw/source/core/doc/extinput.cxx index 7ea91125b876..6a64368217b6 100644 --- a/sw/source/core/doc/extinput.cxx +++ b/sw/source/core/doc/extinput.cxx @@ -161,8 +161,17 @@ void SwExtTextInput::SetInputData( const CommandExtTextInputData& rData ) // We have to insert some characters from the saved original text nReplace -= nNewLen; aIdx += nNewLen; - pTNd->ReplaceText( aIdx, nReplace, - m_sOverwriteText.copy( nNewLen, nReplace )); + + // tdf#148991: When an IME is dismissed during overwrite, nNewLen will be 0 + // and the original text will be contained in m_sOverwriteText. That original + // text may be shorter than the replaced text, so clamp the copy range. + sal_Int32 nOWLen = m_sOverwriteText.getLength(); + if (nNewLen <= nOWLen) + { + sal_Int32 nOWReplace = std::min(nOWLen, nNewLen + nReplace) - nNewLen; + pTNd->ReplaceText(aIdx, nReplace, m_sOverwriteText.copy(nNewLen, nOWReplace)); + } + aIdx = nSttCnt; nReplace = nNewLen; }
