[Libreoffice-commits] core.git: vcl/unx

[Libreoffice Gerrit user]

 vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 1f5698ba8b62e62999b0efb363916a91bdd54c94
Author:     Michael Weghorn <m.weghorn at posteo.de>
AuthorDate: Wed Sep 5 18:03:06 2018 +0200
Commit:     Michael Weghorn <m.weghorn at posteo.de>
CommitDate: Thu Sep 6 08:28:44 2018 +0200

    tdf#119685 Fix infinite loop in gtk3_kde5 filepicker
    
    Since 'string::find()' returns the position of the given
    character in the string and that was passed as the amount of
    characters to delete from the string, 'm_responseBuffer'
    would always be a string starting with a newline character
    afterwards, when this part of the code was reached.
    
    Subsequent calls to 'Gtk3KDE5FilePickerIpc::readResponseLine'
    therefore always returned an empty string and left
    'm_responseBuffer' unchanged, resulting in the lambda function
    inside 'readResponse' in 'gtk3_kde5_filepicker_ipc.hxx' to
    loop infinitely.
    
    While at it, make a little more explicit that 'it' is of type
    'size_t' here.
    
    Change-Id: I3b1c209f8307ab71465d9538a82616dff8656415
    Reviewed-on: https://gerrit.libreoffice.org/60047
    Tested-by: Jenkins
    Reviewed-by: Michael Weghorn <m.weghorn at posteo.de>

diff --git a/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx b/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx
index 21690c5e74f8..8cec9d853fbc 100644
--- a/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx
+++ b/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx
@@ -222,11 +222,11 @@ std::string Gtk3KDE5FilePickerIpc::readResponseLine()
 {
     if (!m_responseBuffer.empty()) // check whether we have a line in our buffer
     {
-        auto it = m_responseBuffer.find('\n');
+        std::size_t it = m_responseBuffer.find('\n');
         if (it != std::string::npos)
         {
             auto ret = m_responseBuffer.substr(0, it);
-            m_responseBuffer.erase(0, it);
+            m_responseBuffer.erase(0, it + 1);
             return ret;
         }
     }