[Libreoffice-commits] core.git: Branch 'libreoffice-5-1' - formula/source

[Eike Rathke]

 formula/source/ui/dlg/formula.cxx |   11 ++++++++++-
 formula/source/ui/dlg/parawin.cxx |   13 +++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

New commits:
commit ab28a0803a61850b0f874fa4c98f6bd0d7861df6
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Dec 18 00:09:01 2015 +0100

    Function Wizard shoots itself in the foot
    
    Currently the Function Wizard is broken in that editing a function call
    as argument within another function's parameter leads to selections
    being reset and mismatching argument/function information being
    evaluated. Not sure yet what's going on there, but at least don't access
    vectors out-of-bounds or crash.
    
    Change-Id: I633c775556a0b90278d22d0f74d2975c20a08a5d
    (cherry picked from commit 88f3c8f995e04aaecc9c7fefe4fe347e87d5e05e)

diff --git a/formula/source/ui/dlg/formula.cxx b/formula/source/ui/dlg/formula.cxx
index 8b87bdf..0448045 100644
--- a/formula/source/ui/dlg/formula.cxx
+++ b/formula/source/ui/dlg/formula.cxx
@@ -1417,12 +1417,21 @@ void FormulaDlg_Impl::UpdateSelection()
     sal_Int32 nArgPos=m_aFormulaHelper.GetArgStart( aFormula,PrivStart,0);
 
     sal_uInt16 nPos=pParaWin->GetActiveLine();
+    if (nPos >= m_aArguments.size())
+    {
+        SAL_WARN("formula.ui","FormulaDlg_Impl::UpdateSelection - shot in foot: nPos " <<
+                nPos << " >= m_aArguments.size() " << m_aArguments.size() <<
+                " for aFormula '" << aFormula << "'");
+        nPos = m_aArguments.size();
+        if (nPos)
+            --nPos;
+    }
 
     for(sal_uInt16 i=0;i<nPos;i++)
     {
         nArgPos += (m_aArguments[i].getLength() + 1);
     }
-    sal_Int32 nLength= m_aArguments[nPos].getLength();
+    sal_Int32 nLength = (nPos < m_aArguments.size()) ? m_aArguments[nPos].getLength() : 0;
 
     Selection aSel(nArgPos,nArgPos+nLength);
     m_pHelper->setSelection((sal_uInt16)nArgPos,(sal_uInt16)(nArgPos+nLength));
diff --git a/formula/source/ui/dlg/parawin.cxx b/formula/source/ui/dlg/parawin.cxx
index fe41e6b..ed9aa3e 100644
--- a/formula/source/ui/dlg/parawin.cxx
+++ b/formula/source/ui/dlg/parawin.cxx
@@ -638,9 +638,18 @@ IMPL_LINK_TYPED( ParaWin, ModifyHdl, ArgInput&, rPtr, void )
     }
     if(nEdFocus!=NOT_FOUND)
     {
-        aParaArray[nEdFocus+nOffset] = aArgInput[nEdFocus].GetArgVal();
+        size_t nPara = nEdFocus + nOffset;
+        if (nPara < aParaArray.size())
+            aParaArray[nPara] = aArgInput[nEdFocus].GetArgVal();
+        else
+        {
+            SAL_WARN("formula.ui","ParaWin::ModifyHdl - shot in foot: nPara " <<
+                    nPara << " >= aParaArray.size() " << aParaArray.size() <<
+                    " with nEdFocus " << nEdFocus <<
+                    " and aArgInput[nEdFocus].GetArgVal() '" << aArgInput[nEdFocus].GetArgVal() << "'");
+        }
         UpdateArgDesc( nEdFocus);
-        nActiveLine=nEdFocus+nOffset;
+        nActiveLine = static_cast<sal_uInt16>(nPara);
     }
 
     ArgumentModified();