From 647ce83f41e7cda6ef8171c575c6c1ec5245b43f Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Thu, 2 Apr 2015 23:33:41 +0200 Subject: [PATCH 2/4] sw: fix crash on SwUndoDelete after select-all with table at start MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Somehow the Redo leaves the shell cursor at an invalid offset into the paragraph, which then leads to out-of-bounds string access. Noticed that SwUndRng::SetPaM() leaves an invalid nContent.m_nIndex on the start position, due to a surprising omission in SwIndex::ChgValue(). (regression from 555ff26501d1bbd8a7872c20671c6303db1e1701) Change-Id: I6e6ad7f70835d7e9d6da1fb680e2ae15469fad71 (cherry picked from commit b24a15a0aaea310806259eaa20a7d509ce30e5c8) Reviewed-on: https://gerrit.libreoffice.org/15128 Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara (cherry picked from commit add86b9d5fcf3cb52549e64be148ba9e7bb4005e) --- sw/source/core/bastyp/index.cxx | 1 + sw/source/core/edit/eddel.cxx | 1 + 2 files changed, 2 insertions(+) diff --git a/sw/source/core/bastyp/index.cxx b/sw/source/core/bastyp/index.cxx index 81da0bb..88eb691 100644 --- a/sw/source/core/bastyp/index.cxx +++ b/sw/source/core/bastyp/index.cxx @@ -80,6 +80,7 @@ SwIndex& SwIndex::ChgValue( const SwIndex& rIdx, sal_Int32 nNewValue ) assert(m_pIndexReg == rIdx.m_pIndexReg); if (!m_pIndexReg) { + m_nIndex = 0; return *this; // no IndexReg => no list to sort into; m_nIndex is 0 } SwIndex* pFnd = const_cast(&rIdx); diff --git a/sw/source/core/edit/eddel.cxx b/sw/source/core/edit/eddel.cxx index fad1eaf..9e2c7b2 100644 --- a/sw/source/core/edit/eddel.cxx +++ b/sw/source/core/edit/eddel.cxx @@ -98,6 +98,7 @@ void SwEditShell::DeleteSel( SwPaM& rPam, bool* pUndo ) // Selection starts at the first para of the first cell, but we // want to delete the table node before the first cell as well. pNewPam->Start()->nNode = pNewPam->Start()->nNode.GetNode().FindTableNode()->GetIndex(); + pNewPam->Start()->nContent.Assign(nullptr, 0); pPam = pNewPam.get(); } // delete everything -- 2.1.0