[Libreoffice-bugs] [Bug 123637] New: Crash when Navigate By Headings search wraps from end to beginning of file

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=123637

            Bug ID: 123637
           Summary: Crash when Navigate By Headings search wraps from end
                    to beginning of file
           Product: LibreOffice
           Version: 6.2.0.0.beta1+
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: medium
         Component: Writer
          Assignee: libreoffice-bugs at lists.freedesktop.org
          Reporter: raykowj at gmail.com

Created attachment 149500
  --> https://bugs.documentfoundation.org/attachment.cgi?id=149500&action=edit
Headings search crash test file

Steps to repro:

1) Open writer with the attached file
2) Menu > View > Toolbars > Find
3) Select Headings in the Navigate By list box
4) Press the Next Heading control until crash occurs (4 presses)

I have traced the bug to the following commit:

commit d0e9cc832d19b622532f01580d9cf78ee0b215db
Author: Michael Stahl <Michael.Stahl at cib.de>, Thu Oct 25 11:06:38 2018 +0200 (4
months ago)
Committer: Michael Stahl <Michael.Stahl at cib.de>, Thu Nov 15 15:10:02 2018 +0100
(3 months ago)
Follows: libreoffice-6-2-branch-point
Precedes: libreoffice-6.2.0.0.beta1

sw_redlinehide_3: adapt GotoOutline for SwCursrShell

Adapt SwDoc::GotoOutline(), SwCursorShell::GotoNextOutline(),
SwCursorShell::GotoPrevOutline() to skip over outline nodes that are
merged away in the layout.

Change-Id: Id6f6bb93177753ed21a438c89dc6d90098e11455

It seems to be an issue with accessing an array out of bounds.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20190221/b92ae153/attachment.html>