sw/source/core/unocore/unoframe.cxx |    8 ++++++++
 1 file changed, 8 insertions(+)

New commits:
commit 7072175b6e5fb6bb5c528a917c246091e19b599e
Author:     Michael Stahl <[email protected]>
AuthorDate: Mon Nov 17 19:28:39 2025 +0100
Commit:     Caolán McNamara <[email protected]>
CommitDate: Sat Nov 29 15:17:20 2025 +0100

    sw: prevent anchoring SwXFrame to itself
    
    ooo30979-1.doc, converted to rtf, then loaded by writerfilter will
    create a text frame anchored to its own 2nd paragraph, triggering:
    
      sw/source/core/doc/doclay.cxx:1591: bool SwDoc::IsInHeaderFooter(const 
SwNode&) const: Assertion `pNd != rAnchor.GetAnchorNode()' failed.
    
    Change-Id: I5d0ee2ea406273ca42a50047b40a6d8d8d759f0c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/194121
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 99c7fea26120811dc045bc221f886ca2cca3f9d5)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/194213
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/sw/source/core/unocore/unoframe.cxx 
b/sw/source/core/unocore/unoframe.cxx
index a5c4fb9cf86b..eb961b0d5ae9 100644
--- a/sw/source/core/unocore/unoframe.cxx
+++ b/sw/source/core/unocore/unoframe.cxx
@@ -3076,6 +3076,14 @@ void SwXFrame::attach(const uno::Reference< 
text::XTextRange > & xTextRange)
     if (!::sw::XTextRangeToSwPaM(aIntPam, xTextRange))
         throw lang::IllegalArgumentException();
 
+    if (SwStartNode const*const 
pFly{aIntPam.GetPoint()->GetNode().FindFlyStartNode()})
+    {
+        if (pFly == &pFormat->GetContent().GetContentIdx()->GetNode())
+        {
+            throw lang::IllegalArgumentException(u"cannot anchor object to 
itself"_ustr, nullptr, 1);
+        }
+    }
+
     SfxItemSetFixed<RES_ANCHOR, RES_ANCHOR> aSet( rDoc.GetAttrPool() );
     aSet.SetParent(&pFormat->GetAttrSet());
     SwFormatAnchor aAnchor = aSet.Get(RES_ANCHOR);

Reply via email to