[Libreoffice-commits] core.git: sw/source

[Michael Stahl]

 sw/source/core/bastyp/swcache.cxx |   26 ++++++++++++++++++++++++--
 sw/source/core/inc/swcache.hxx    |   19 ++-----------------
 2 files changed, 26 insertions(+), 19 deletions(-)

New commits:
commit 21d664e987861a8bc9b6ddbab96156f384b8a369
Author: Michael Stahl <mstahl at redhat.com>
Date:   Thu Feb 1 22:27:14 2018 +0100

    ofz#5435 sw: fix crash during painting of excessively nested tables
    
    Could not find a single instance where the return value of
    SwCacheAccess::Get() was actually checked, so let's have
    SwCache::Insert() automatically resize the cache, since it starts
    out with just 100 capacity; also, check that the size doesn't overflow.
    
    Change-Id: I3cd7cf2aea79e01816b12e4dbaf79c3bf82bf8fe
    Reviewed-on: https://gerrit.libreoffice.org/49140
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/source/core/bastyp/swcache.cxx b/sw/source/core/bastyp/swcache.cxx
index 200c8f59f4ab..f84c9241c07c 100644
--- a/sw/source/core/bastyp/swcache.cxx
+++ b/sw/source/core/bastyp/swcache.cxx
@@ -19,6 +19,7 @@
 
 #include <swcache.hxx>
 
+#include <o3tl/safeint.hxx>
 #include <rtl/strbuf.hxx>
 #include <osl/diagnose.h>
 
@@ -123,6 +124,26 @@ SwCache::~SwCache()
         delete *it;
 }
 
+void SwCache::IncreaseMax( const sal_uInt16 nAdd )
+{
+    if (o3tl::checked_add(m_nCurMax, nAdd, m_nCurMax))
+    {
+        std::abort();
+    }
+#ifdef DBG_UTIL
+    ++m_nIncreaseMax;
+#endif
+}
+
+void SwCache::DecreaseMax( const sal_uInt16 nSub )
+{
+    if ( m_nCurMax > nSub )
+        m_nCurMax = m_nCurMax - sal::static_int_cast< sal_uInt16 >(nSub);
+#ifdef DBG_UTIL
+    ++m_nDecreaseMax;
+#endif
+}
+
 void SwCache::Flush()
 {
     INCREMENT( m_nFlushCnt );
@@ -361,8 +382,9 @@ bool SwCache::Insert( SwCacheObj *pNew )
             pObj = pObj->GetPrev();
         if ( !pObj )
         {
-            OSL_FAIL( "Cache overflow." );
-            return false;
+            SAL_WARN("sw.core", "SwCache overflow.");
+            IncreaseMax(100); // embiggen & try again
+            return Insert(pNew);
         }
 
         nPos = pObj->GetCachePos();
diff --git a/sw/source/core/inc/swcache.hxx b/sw/source/core/inc/swcache.hxx
index f3e1a327b22a..182da7225bce 100644
--- a/sw/source/core/inc/swcache.hxx
+++ b/sw/source/core/inc/swcache.hxx
@@ -107,8 +107,8 @@ public:
     void SetLRUOfst( const sal_uInt16 nOfst );  /// nOfst determines how many are not to be touched
     void ResetLRUOfst() { m_pFirst = m_pRealFirst; }
 
-    inline void IncreaseMax( const sal_uInt16 nAdd );
-    inline void DecreaseMax( const sal_uInt16 nSub );
+    void IncreaseMax( const sal_uInt16 nAdd );
+    void DecreaseMax( const sal_uInt16 nSub );
     sal_uInt16 GetCurMax() const { return m_nCurMax; }
     SwCacheObj *First() { return m_pRealFirst; }
     static inline SwCacheObj *Next( SwCacheObj *pCacheObj);
@@ -212,21 +212,6 @@ public:
     bool IsAvail() const { return m_pObj != nullptr; }
 };
 
-inline void SwCache::IncreaseMax( const sal_uInt16 nAdd )
-{
-    m_nCurMax = m_nCurMax + sal::static_int_cast< sal_uInt16 >(nAdd);
-#ifdef DBG_UTIL
-    ++m_nIncreaseMax;
-#endif
-}
-inline void SwCache::DecreaseMax( const sal_uInt16 nSub )
-{
-    if ( m_nCurMax > nSub )
-        m_nCurMax = m_nCurMax - sal::static_int_cast< sal_uInt16 >(nSub);
-#ifdef DBG_UTIL
-    ++m_nDecreaseMax;
-#endif
-}
 
 inline bool SwCacheObj::IsOwner( const void *pNew ) const
 {