[PATCH libreoffice-4-0] fdo#60732: check max size in SwTxtNode::ReplaceText

[Michael Stahl (via Code Review)]

Hi,

I have submitted a patch for review:

    https://gerrit.libreoffice.org/2181

To pull it, you can do:

    git pull ssh://gerrit.libreoffice.org:29418/core refs/changes/81/2181/1

fdo#60732: check max size in SwTxtNode::ReplaceText

Also adjust SwUndoReplace to not assume that everything was inserted and
use the stored indexes instead in Undo.

Change-Id: I52f3aaf063c2b1bd52381bdc19e29a41a12c3847
(cherry picked from commit b6d45f26ea5bcc848737921b59a16253eb1d8587)
---
M sw/inc/ndtxt.hxx
M sw/source/core/txtnode/ndtxt.cxx
M sw/source/core/undo/unins.cxx
3 files changed, 25 insertions(+), 19 deletions(-)



diff --git a/sw/inc/ndtxt.hxx b/sw/inc/ndtxt.hxx
index 57bca6b..985e6e8 100644
--- a/sw/inc/ndtxt.hxx
+++ b/sw/inc/ndtxt.hxx
@@ -333,6 +333,8 @@
                     const SwIndex & rStart, const xub_StrLen nLen);
 
     /// replace nDelLen characters at rStart with rText
+    /// in case the replacement does not fit, it is partially inserted up to
+    /// TXTNODE_MAX
     void ReplaceText( const SwIndex& rStart, const xub_StrLen nDelLen,
             const XubString& rText );
     void ReplaceTextOnly( xub_StrLen nPos, xub_StrLen nLen, const XubString& rText,
diff --git a/sw/source/core/txtnode/ndtxt.cxx b/sw/source/core/txtnode/ndtxt.cxx
index db87a6a..c8182b6 100644
--- a/sw/source/core/txtnode/ndtxt.cxx
+++ b/sw/source/core/txtnode/ndtxt.cxx
@@ -3325,11 +3325,23 @@
  *************************************************************************/
 
 void SwTxtNode::ReplaceText( const SwIndex& rStart, const xub_StrLen nDelLen,
-                             const XubString& rText )
+                             const XubString& rStr)
 {
     OSL_ENSURE( rStart.GetIndex() < m_Text.Len() &&
             rStart.GetIndex() + nDelLen <= m_Text.Len(),
             "SwTxtNode::ReplaceText: index out of bounds" );
+
+    ssize_t const nOverflow(static_cast<ssize_t>(m_Text.Len())
+            + static_cast<ssize_t>(rStr.Len()) - nDelLen - TXTNODE_MAX);
+    SAL_WARN_IF(nOverflow > 0, "sw.core",
+            "SwTxtNode::ReplaceText: node text with insertion > TXTNODE_MAX.");
+    OUString const sInserted(
+            (nOverflow > 0) ? rStr.Copy(0, rStr.Len() - nOverflow) : rStr);
+    if (sInserted.isEmpty())
+    {
+        return;
+    }
+
     const xub_StrLen nStartPos = rStart.GetIndex();
     xub_StrLen nEndPos = nStartPos + nDelLen;
     xub_StrLen nLen = nDelLen;
@@ -3356,17 +3368,17 @@
     bool bOldExpFlg = IsIgnoreDontExpand();
     SetIgnoreDontExpand( true );
 
-    if( nLen && rText.Len() )
+    if (nLen && sInserted.getLength())
     {
         // dann das 1. Zeichen ersetzen den Rest loschen und einfuegen
         // Dadurch wird die Attributierung des 1. Zeichen expandiert!
-        m_Text.SetChar( nStartPos, rText.GetChar( 0 ) );
+        m_Text.SetChar( nStartPos, sInserted[0] );
 
         ++((SwIndex&)rStart);
         m_Text.Erase( rStart.GetIndex(), nLen - 1 );
         Update( rStart, nLen - 1, true );
 
-        XubString aTmpTxt( rText ); aTmpTxt.Erase( 0, 1 );
+        XubString aTmpTxt(sInserted); aTmpTxt.Erase( 0, 1 );
         m_Text.Insert( aTmpTxt, rStart.GetIndex() );
         Update( rStart, aTmpTxt.Len(), false );
     }
@@ -3375,15 +3387,15 @@
         m_Text.Erase( nStartPos, nLen );
         Update( rStart, nLen, true );
 
-        m_Text.Insert( rText, nStartPos );
-        Update( rStart, rText.Len(), false );
+        m_Text.Insert( sInserted, nStartPos );
+        Update( rStart, sInserted.getLength(), false );
     }
 
     SetIgnoreDontExpand( bOldExpFlg );
     SwDelTxt aDelHint( nStartPos, nDelLen );
     NotifyClients( 0, &aDelHint );
 
-    SwInsTxt aHint( nStartPos, rText.Len() );
+    SwInsTxt aHint( nStartPos, sInserted.getLength() );
     NotifyClients( 0, &aHint );
 }
 
diff --git a/sw/source/core/undo/unins.cxx b/sw/source/core/undo/unins.cxx
index 7018dd1..745d6ce 100644
--- a/sw/source/core/undo/unins.cxx
+++ b/sw/source/core/undo/unins.cxx
@@ -680,11 +680,7 @@
     }
 
     SwIndex aIdx( pNd, m_nSttCnt );
-    if( m_nSttNd == m_nEndNd )
-    {
-        pNd->EraseText( aIdx, sal_uInt16( m_sIns.getLength() ) );
-    }
-    else
+    // don't look at m_sIns for deletion, maybe it was not completely inserted
     {
         rPam.GetPoint()->nNode = *pNd;
         rPam.GetPoint()->nContent.Assign( pNd, m_nSttCnt );
@@ -791,13 +787,9 @@
 
 void SwUndoReplace::Impl::SetEnd(SwPaM const& rPam)
 {
-    if( rPam.GetPoint()->nNode != rPam.GetMark()->nNode )
-    {
-        // multiple paragraphs were inserted
-        const SwPosition* pEnd = rPam.End();
-        m_nEndNd = m_nOffset + pEnd->nNode.GetIndex();
-        m_nEndCnt = pEnd->nContent.GetIndex();
-    }
+    const SwPosition* pEnd = rPam.End();
+    m_nEndNd = m_nOffset + pEnd->nNode.GetIndex();
+    m_nEndCnt = pEnd->nContent.GetIndex();
 }
 
 

-- 
To view, visit https://gerrit.libreoffice.org/2181
To unsubscribe, visit https://gerrit.libreoffice.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I52f3aaf063c2b1bd52381bdc19e29a41a12c3847
Gerrit-PatchSet: 1
Gerrit-Project: core
Gerrit-Branch: libreoffice-4-0
Gerrit-Owner: Michael Stahl <mstahl at redhat.com>