sd/source/core/drawdoc2.cxx | 4 ++++
1 file changed, 4 insertions(+)
New commits:
commit e68c2e9e5dbd92d23da549265280c5fee9537cbd
Author: Mohit Marathe <[email protected]>
AuthorDate: Fri Jan 16 20:44:34 2026 +0530
Commit: Michael Stahl <[email protected]>
CommitDate: Mon Jan 19 12:53:22 2026 +0100
sd: clamp insert position to page count in SdDrawDocument::InsertPageSet
This prevents integer overflow when nInsertPosition is 0xFFFF and
SetupNewPage is called for notes page by passing nInsertPosition+1.
Hence, preventing messing up the page order.
Signed-off-by: Mohit Marathe <[email protected]>
Change-Id: Iee52defb2ade0bf03150e52d3cfb48ca45e9b4a4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197460
Tested-by: Jenkins CollaboraOffice <[email protected]>
Reviewed-by: Michael Stahl <[email protected]>
diff --git a/sd/source/core/drawdoc2.cxx b/sd/source/core/drawdoc2.cxx
index 15d1f30ea475..006a4dcba4a3 100644
--- a/sd/source/core/drawdoc2.cxx
+++ b/sd/source/core/drawdoc2.cxx
@@ -1423,6 +1423,10 @@ sal_uInt16 SdDrawDocument::InsertPageSet (
sal_uInt16 nNotesPageNum;
OUString aNotesPageName(sNotesPageName);
+ sal_uInt16 nCount = GetPageCount();
+ if (nInsertPosition > nCount)
+ nInsertPosition = nCount;
+
// Gather some information about the standard page and the notes page
// that are to be inserted. This makes sure that there is always one
// standard page followed by one notes page.
