[Libreoffice-bugs] [Bug 38071] New: crash on export of multi line form text fields to .doc

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=38071

           Summary: crash on export of multi line form text fields to .doc
           Product: LibreOffice
           Version: unspecified
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Libreoffice
        AssignedTo: libreoffice-bugs at lists.freedesktop.org
        ReportedBy: caolanm at redhat.com


Created an attachment (id=47713)
 View: https://bugs.freedesktop.org/attachment.cgi?id=47713
 Review: https://bugs.freedesktop.org/review?bug=38071&attachment=47713

propose fix

If the last line is empty, and consists of only the field-end char then...

we have...

if ( ch == CH_TXT_ATR_FIELDEND )
    SwPosition aPosition( rNode, SwIndex( const_cast< SwTxtNode* >( &rNode ),
nAktPos - 1 ) );

...

so taking the sample .doc attached, load it, place cursor on second line of
field and delete the single space in it, save it => crash

when looking at the CH_TXT_ATR_FIELDEND char we're at position 0 in that
SwNode, getting nAktPos-1 to look at the content before the field-end is
busted, because it assumes that the previous char is in the same SwNode, so we
get an invalid -1 pos in the current node, not the last pos in the previous
node.

Looking at MarkBase::IsCoveringPosition I see that we currently have...

return GetMarkStart() <= rPos && rPos < GetMarkEnd();

which suggests that the starting CH_TXT_ATR_FIELDBEGIN char is considered part
of the coveredrange, but that the FIELDEND is not.

How about keeping it simple and consider both the field start and end chars as
part of the range.

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.