[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/ww6/pass/crash-6.doc |binary
 sw/source/filter/basflt/fltshell.cxx |   13 ++++++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

New commits:
commit 4efb0056f24698516aa5550ec926255da45a2381
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Aug 22 10:31:35 2015 +0100

    check that src index is in doc range
    
    (cherry picked from commit 3230c8cf1cf2dc486f038d369e7f4f44ffd6b0a7)
    
    check that dest index is in doc range
    
    (cherry picked from commit cd6c9aef7468120dd5ea5c747f35c98baf214613)
    
    Change-Id: Ic81e7a14701ff30aa46a9293dd6db351bd350ba5
    3006cf03cf97399a6c418162178acdb1d41c3b23
    Reviewed-on: https://gerrit.libreoffice.org/17928
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sw/qa/core/data/ww6/pass/crash-6.doc b/sw/qa/core/data/ww6/pass/crash-6.doc
new file mode 100644
index 0000000..08c8791
Binary files /dev/null and b/sw/qa/core/data/ww6/pass/crash-6.doc differ
diff --git a/sw/source/filter/basflt/fltshell.cxx b/sw/source/filter/basflt/fltshell.cxx
index 53a9b66..549731a 100644
--- a/sw/source/filter/basflt/fltshell.cxx
+++ b/sw/source/filter/basflt/fltshell.cxx
@@ -120,8 +120,11 @@ bool SwFltStackEntry::MakeRegion(SwDoc* pDoc, SwPaM& rRegion, bool bCheck,
 
     // The only position of 0x0D will not be able to make region in the old logic
     // because it is beyond the length of para...need special consideration here.
-    SwCntntNode *const pCntntNode(
-        SwNodeIndex(rMkPos.m_nNode, +1).GetNode().GetCntntNode());
+    sal_uLong nMk = rMkPos.m_nNode.GetIndex() + 1;
+    const SwNodes& rMkNodes = rMkPos.m_nNode.GetNodes();
+    if (nMk >= rMkNodes.Count())
+        return false;
+    SwCntntNode *const pCntntNode(rMkNodes[nMk]->GetCntntNode());
     if (rMkPos == rPtPos &&
         ((0 != rPtPos.m_nCntnt) || (pCntntNode && (0 != pCntntNode->Len())))
         && ( RES_TXTATR_FIELD != nWhich
@@ -138,7 +141,11 @@ bool SwFltStackEntry::MakeRegion(SwDoc* pDoc, SwPaM& rRegion, bool bCheck,
     rRegion.SetMark();
     if (rMkPos.m_nNode != rPtPos.m_nNode)
     {
-        rRegion.GetPoint()->nNode = rPtPos.m_nNode.GetIndex() + 1;
+        sal_uLong n = rPtPos.m_nNode.GetIndex() + 1;
+        SwNodes& rNodes = rRegion.GetPoint()->nNode.GetNodes();
+        if (n >= rNodes.Count())
+            return false;
+        rRegion.GetPoint()->nNode = n;
         pCNd = GetCntntNode(pDoc, rRegion.GetPoint()->nNode, false);
     }
     rRegion.GetPoint()->nContent.Assign(pCNd, rPtPos.m_nCntnt);