[Libreoffice-commits] core.git: 2 commits - sw/source

[Matúš Kukan]

 sw/source/core/table/swnewtable.cxx |   27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

New commits:
commit f13cf2437f34402ef76bec6dc2c77f9f388f15b8
Author: Matúš Kukan <matus.kukan at gmail.com>
Date:   Thu Apr 23 08:13:38 2015 +0200

    Avoid out-of-bounds container index on import of ooo112657-2.rtf
    
    Change-Id: I47dfab3cf276919bfef2829e1159857abb05bb3d

diff --git a/sw/source/core/table/swnewtable.cxx b/sw/source/core/table/swnewtable.cxx
index 89b07f1..f844257 100644
--- a/sw/source/core/table/swnewtable.cxx
+++ b/sw/source/core/table/swnewtable.cxx
@@ -377,7 +377,7 @@ SwBoxSelection* SwTable::CollectBoxSelection( const SwPaM& rPam ) const
     long nRightSpan = 0;
     long nLeftSpanCnt = 0;
     long nRightSpanCnt = 0;
-    for( size_t nRow = nTop; nRow <= nBottom && bOkay; ++nRow )
+    for( size_t nRow = nTop; nRow <= nBottom && bOkay && nRow < nLines; ++nRow )
     {
         SwTableLine* pLine = aLines[nRow];
         OSL_ENSURE( pLine, "Missing table line" );
commit c33422e2c21ed8160fbbb969698216a8a1aeb0b8
Author: Matúš Kukan <matus.kukan at gmail.com>
Date:   Wed Apr 22 19:46:18 2015 +0200

    Avoid dereference a past-the-end iterator on import of fdo81650-2.docx
    
    Change-Id: I8b503da737b3f3c35e7dee18166068323ef6f76e

diff --git a/sw/source/core/table/swnewtable.cxx b/sw/source/core/table/swnewtable.cxx
index fb1f78b..89b07f1 100644
--- a/sw/source/core/table/swnewtable.cxx
+++ b/sw/source/core/table/swnewtable.cxx
@@ -2126,19 +2126,22 @@ void SwTable::CheckConsistency() const
             {
                 SAL_WARN_IF( aIter == aRowSpanCells.end(),
                         "sw.core", "Missing master box");
-                SAL_WARN_IF( aIter->nLeft != nWidth || aIter->nRight != nNewWidth,
-                    "sw.core", "Wrong position/size of overlapped table box");
-                --(aIter->nRowSpan);
-                SAL_WARN_IF( aIter->nRowSpan != -nRowSp, "sw.core",
-                        "Wrong row span value" );
-                if( nRowSp == -1 )
+                if (aIter != aRowSpanCells.end())
                 {
-                    std::list< RowSpanCheck >::iterator aEraseIter = aIter;
-                    ++aIter;
-                    aRowSpanCells.erase( aEraseIter );
+                    SAL_WARN_IF( aIter->nLeft != nWidth || aIter->nRight != nNewWidth,
+                        "sw.core", "Wrong position/size of overlapped table box");
+                    --(aIter->nRowSpan);
+                    SAL_WARN_IF( aIter->nRowSpan != -nRowSp, "sw.core",
+                            "Wrong row span value" );
+                    if( nRowSp == -1 )
+                    {
+                        std::list< RowSpanCheck >::iterator aEraseIter = aIter;
+                        ++aIter;
+                        aRowSpanCells.erase( aEraseIter );
+                    }
+                    else
+                        ++aIter;
                 }
-                else
-                    ++aIter;
             }
             else if( nRowSp != 1 )
             {