[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - sw/source

[Michael Stahl]

 sw/source/core/frmedt/tblsel.cxx |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

New commits:
commit 841fe2a12ea24c5f1ed61e48e15939b3b05acc5d
Author: Michael Stahl <mstahl at redhat.com>
Date:   Mon Jun 30 23:22:10 2014 +0200

    fdo#80663: sw: fix crash on Undo of table row/column delete
    
    The _FndBox appears to handle an empty table lines vector, but evidently
    it does not check its indexes properly in this case, which crashes with
    STL containers.
    
    (regression from bc0c939270a45469b8f22008288b5e4a4d9c9861)
    
    Change-Id: Id864ea12bc97e61c5251f470e446b6b8f69cb054
    (cherry picked from commit 2c157249207552e193e52f5ab7fad5b37ae0a748)
    Reviewed-on: https://gerrit.libreoffice.org/9999
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/source/core/frmedt/tblsel.cxx b/sw/source/core/frmedt/tblsel.cxx
index c0ec660..362d475 100644
--- a/sw/source/core/frmedt/tblsel.cxx
+++ b/sw/source/core/frmedt/tblsel.cxx
@@ -2110,7 +2110,7 @@ void _FndBox::SetTableLines( const SwSelBoxes &rBoxes, const SwTable &rTable )
         if( nEndPos < nPos )
             nEndPos = nPos;
     }
-    if ( nStPos > 1 )
+    if (USHRT_MAX != nStPos && nStPos > 1)
         pLineBefore = rTable.GetTabLines()[nStPos - 2];
     if ( nEndPos < rTable.GetTabLines().size() )
         pLineBehind = rTable.GetTabLines()[nEndPos];
@@ -2173,7 +2173,8 @@ void _FndBox::DelFrms( SwTable &rTable, bool bAccTableDispose )
         nEndPos = rTable.GetTabLines().GetPos(
                         (const SwTableLine*&)pLineBehind );
         OSL_ENSURE( nEndPos != USHRT_MAX, "The fox stole the line!" );
-        --nEndPos;
+        if (nEndPos != 0)
+            --nEndPos;
     }
 
     for ( sal_uInt16 i = nStPos; i <= nEndPos; ++i)