[Libreoffice-commits] core.git: sw/source

[Miklos Vajna]

 sw/source/core/unocore/unotbl.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit bb562304c1e1c61a882e6db65806cfdf8601bcbf
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Fri Dec 27 20:46:50 2013 +0100

    Related: fdo#65090 Fix crash in SwXTextTableCursor::mergeRange()
    
    Regression from b844f06b36cf9a6c1411861a08701c8f9be2af0d (fdo#48692: fix
    problems with large number of table cells, 2012-09-21), the problem was
    that GetSelectedBoxesCount() may return 0, and if that happens, the
    prefix decrement operator set nCount to 0xffffffffffffffff, which then
    resulted in a call to DeleteBox(), which did not happen before.
    
    Thanks debug STL for pointing out this issue.
    
    Change-Id: I9eee55f642726343c4ce9af479ccd2c4dde03b6a

diff --git a/sw/source/core/unocore/unotbl.cxx b/sw/source/core/unocore/unotbl.cxx
index fad3242..9702a50 100644
--- a/sw/source/core/unocore/unotbl.cxx
+++ b/sw/source/core/unocore/unotbl.cxx
@@ -1720,7 +1720,7 @@ sal_Bool SwXTextTableCursor::mergeRange(void) throw( uno::RuntimeException )
             if(bRet)
             {
                 size_t nCount = pTblCrsr->GetSelectedBoxesCount();
-                while (--nCount)
+                while (nCount--)
                 {
                     pTblCrsr->DeleteBox(nCount);
                 }