https://bz.apache.org/ooo/show_bug.cgi?id=128579
--- Comment #4 from dam...@apache.org ---
This patch seems to stop the crash when applied to the original regression
commit (a890f778ee). Let's see whether it works on the latest trunk too.
---snip---
diff --git a/main/editeng/source/editeng/editdoc2.cxx
b/main/editeng/source/editeng/editdoc2.cxx
index 327872b474..604a658a7b 100644
--- a/main/editeng/source/editeng/editdoc2.cxx
+++ b/main/editeng/source/editeng/editdoc2.cxx
@@ -330,7 +330,7 @@ static sal_uInt32 FastGetPos( const VoidPtr *pPtrArray,
sal_uInt32 nPtrArrayLen,
if( rLastPos > 16 )
{
sal_uInt32 nEnd;
- if (rLastPos > nPtrArrayLen - 2)
+ if (rLastPos + 2 > nPtrArrayLen)
nEnd = nPtrArrayLen;
else
nEnd = rLastPos + 2;
---snip---
--
You are receiving this mail because:
You are the assignee for the issue.
