sw/source/core/text/itrcrsr.cxx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
New commits: commit 895c6f595bba45c9f23cf1820f5a56d337146bdc Author: Michael Stahl <[email protected]> AuthorDate: Tue Jan 23 18:23:12 2024 +0100 Commit: Xisco Fauli <[email protected]> CommitDate: Thu Jan 25 16:18:31 2024 +0100 sw: fix crash in SwTextCursor::GetModelPositionForViewPoint() With a field that spans 3 SwTextFrames, it happens that rText[sal_Int32(nCurrStart + nLength) - 1] results in rText[-1]; it looks like both nCurrStart and nLength are correct (nCurrStart was decremented in line 1531 after "if (bFieldInfo)") so there is a missing check here. Change-Id: I0d5be617e8e54c20dc8633efd3a7d82510f4acd7 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162522 Tested-by: Jenkins Reviewed-by: Michael Stahl <[email protected]> (cherry picked from commit 42a315b4a777dc371297752b6233e437d36c456b) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162545 Tested-by: Michael Stahl <[email protected]> Reviewed-by: Xisco Fauli <[email protected]> diff --git a/sw/source/core/text/itrcrsr.cxx b/sw/source/core/text/itrcrsr.cxx index 431aeea2734d..0081d03b82f5 100644 --- a/sw/source/core/text/itrcrsr.cxx +++ b/sw/source/core/text/itrcrsr.cxx @@ -1610,8 +1610,11 @@ TextFrameIndex SwTextCursor::GetModelPositionForViewPoint( SwPosition *pPos, con // Skip space at the end of the line if( bLastPortion && (m_pCurr->GetNext() || m_pFrame->GetFollow() ) - && rText[sal_Int32(nCurrStart + nLength) - 1] == ' ' ) + && sal_Int32(nLength) != 0 + && rText[sal_Int32(nCurrStart + nLength) - 1] == ' ') + { --nLength; + } if( nWidth > nX || ( nWidth == nX && pPor->IsMultiPortion() && static_cast<SwMultiPortion*>(pPor)->IsDouble() ) )
