cui/source/dialogs/hyphen.cxx |    2 ++
 1 file changed, 2 insertions(+)

New commits:
commit 3ec7b568bf8158ce7e6ba5336ce8af52d7a79d5f
Author:     Noel Grandin <[email protected]>
AuthorDate: Sun Dec 24 19:14:03 2023 +0200
Commit:     Xisco Fauli <[email protected]>
CommitDate: Wed Dec 27 11:21:28 2023 +0100

    tdf#158837 hyphenation crash in: int rtl::str::indexOfStr_WithLength
    
    the code was already dodgy, passing in an invalid nPos, which triggers
    an assert.
    
    However, it appears that previously that dodginess was ignored, until
        commit 5ebccaa07589383653dbd65e58204a82dd3cde09
        author      Noel Grandin    Sat Apr 10 17:27:08 2021 +0200
        use std lib for O[U]String indexOfStr
    which turned it into a crash.
    
    Add a check to avoid the crash, no idea what the right fix would look
    like.
    
    Change-Id: I826b9af0b2d9c7c297214ce2d54c664fb573edd2
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161271
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <[email protected]>
    (cherry picked from commit a89a42e55f2b154c8b276fe08fcf02c4b9fc0945)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161310
    (cherry picked from commit 7af18a423634595dd5ea13d35283e906e46a1662)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161320
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/cui/source/dialogs/hyphen.cxx b/cui/source/dialogs/hyphen.cxx
index 259ec5d03395..10ad1d9bba5b 100644
--- a/cui/source/dialogs/hyphen.cxx
+++ b/cui/source/dialogs/hyphen.cxx
@@ -171,6 +171,8 @@ OUString SvxHyphenWordDialog::EraseUnusableHyphens_Impl()
                 aLeft = aLeft.replaceFirst( aTmp, "", &nPos );
                 if (nPos != -1)
                     ++m_nHyphenationPositionsOffset;
+                if (nPos >= aLeft.getLength()) // tdf#158837
+                    break;
             }
             aTxt = aTxt.replaceAt( 0, nPos2, aLeft );
         }

Reply via email to