[Libreoffice-commits] core.git: Branch 'libreoffice-6-3' - sw/source

[Michael Stahl (via logerrit)]

 sw/source/core/text/txtfrm.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit b2369e031cbf4a370721c9ee45a33001966a6afa
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Mon Sep 23 17:38:33 2019 +0200
Commit:     Xisco Faulí <xiscofauli at libreoffice.org>
CommitDate: Wed Sep 25 12:13:49 2019 +0200

    tdf#127652 sw_redlinehide: don't set invalid SwTextFrame offsets
    
    The obvious problem here is that if a deletion spans multiple text
    frames, the offset of the 2nd one must not be reduced lower than the
    start position of the deletion; apparently this fixes the subsequent
    crashes with stale text portions having now invalid indexes into the
    string.
    
    (regression from 0acde7514e666fc04805fd36503bd174162336ca)
    
    Change-Id: Iaf9e2c5ca06ed36dc0e8611891d19c22f7661d34
    Reviewed-on: https://gerrit.libreoffice.org/79421
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.stahl at cib.de>
    (cherry picked from commit 9ec2c77046901fdacca77753052b54c81e6bc82c)
    Reviewed-on: https://gerrit.libreoffice.org/79432
    Reviewed-by: Xisco Faulí <xiscofauli at libreoffice.org>

diff --git a/sw/source/core/text/txtfrm.cxx b/sw/source/core/text/txtfrm.cxx
index 4d64aa9e4e5a..81e372b49700 100644
--- a/sw/source/core/text/txtfrm.cxx
+++ b/sw/source/core/text/txtfrm.cxx
@@ -1870,7 +1870,8 @@ static void lcl_ModifyOfst(SwTextFrame & rFrame,
     assert(nLen != TextFrameIndex(COMPLETE_STRING));
     if (rFrame.IsFollow() && nPos < rFrame.GetOfst())
     {
-        rFrame.ManipOfst( std::max(TextFrameIndex(0), op(rFrame.GetOfst(), nLen)) );
+        rFrame.ManipOfst( std::max(nPos, op(rFrame.GetOfst(), nLen)) );
+        assert(sal_Int32(rFrame.GetOfst()) <= rFrame.GetText().getLength());
     }
 }