sw/source/core/unocore/unotbl.cxx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit bb562304c1e1c61a882e6db65806cfdf8601bcbf
Author: Miklos Vajna <vmik...@collabora.co.uk>
Date: Fri Dec 27 20:46:50 2013 +0100
Related: fdo#65090 Fix crash in SwXTextTableCursor::mergeRange()
Regression from b844f06b36cf9a6c1411861a08701c8f9be2af0d (fdo#48692: fix
problems with large number of table cells, 2012-09-21), the problem was
that GetSelectedBoxesCount() may return 0, and if that happens, the
prefix decrement operator set nCount to 0xffffffffffffffff, which then
resulted in a call to DeleteBox(), which did not happen before.
Thanks debug STL for pointing out this issue.
Change-Id: I9eee55f642726343c4ce9af479ccd2c4dde03b6a
diff --git a/sw/source/core/unocore/unotbl.cxx
b/sw/source/core/unocore/unotbl.cxx
index fad3242..9702a50 100644
--- a/sw/source/core/unocore/unotbl.cxx
+++ b/sw/source/core/unocore/unotbl.cxx
@@ -1720,7 +1720,7 @@ sal_Bool SwXTextTableCursor::mergeRange(void) throw(
uno::RuntimeException )
if(bRet)
{
size_t nCount = pTblCrsr->GetSelectedBoxesCount();
- while (--nCount)
+ while (nCount--)
{
pTblCrsr->DeleteBox(nCount);
}
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
