sw/source/core/txtnode/fntcache.cxx | 4 ++++ 1 file changed, 4 insertions(+)
New commits: commit 423c3f2cf385549c25c2b5e564f195466f135083 Author: Caolán McNamara <[email protected]> AuthorDate: Thu Mar 17 16:24:16 2022 +0000 Commit: Christian Lohmaier <[email protected]> CommitDate: Wed Mar 23 13:48:26 2022 +0100 Resolves: tdf#148053 fix a crash in out of range dx array also seen with tdf#124116 Change-Id: I211c5b9d58ee5857c8286b2009e4159b35a9e047 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131602 Tested-by: Jenkins Reviewed-by: Xisco Fauli <[email protected]> (cherry picked from commit 29e996bd5e364e1b6b22d88d56d28dac7d3c97d6) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131865 Reviewed-by: Christian Lohmaier <[email protected]> Tested-by: Christian Lohmaier <[email protected]> diff --git a/sw/source/core/txtnode/fntcache.cxx b/sw/source/core/txtnode/fntcache.cxx index 93e83c2013e9..109865861064 100644 --- a/sw/source/core/txtnode/fntcache.cxx +++ b/sw/source/core/txtnode/fntcache.cxx @@ -2258,6 +2258,10 @@ TextFrameIndex SwFntObj::GetModelPositionForViewPoint(SwDrawTextInfo &rInf) if ( nIdx <= nLastIdx ) break; + // the next character might be outside the layout range (e.g tdf124116-1.odt) + if (nIdx > nEnd) + nIdx = nEnd; + nLeft = nRight; nRight = aKernArray[sal_Int32(nIdx - rInf.GetIdx()) - 1] + nKernSum + nSpaceSum;
