sc/source/ui/view/tabvwsha.cxx | 6 ++++-- svx/source/svdraw/svdogrp.cxx | 4 +--- sw/qa/filter/ww8/data/ofz-delflyinrange-1.doc |binary sw/qa/filter/ww8/ww8.cxx | 7 +++++++ sw/source/filter/basflt/fltshell.cxx | 20 ++++++++++++++++++++ 5 files changed, 32 insertions(+), 5 deletions(-)
New commits: commit 57301e8ebe59a0757fc47c8e5c8b6aad5237ef7a Author: Caolán McNamara <[email protected]> AuthorDate: Fri Mar 6 16:33:28 2026 +0000 Commit: Caolán McNamara <[email protected]> CommitDate: Fri Mar 6 20:09:07 2026 +0100 cid#1684041 Variable copied when it could be moved and cid#1684043 Variable copied when it could be moved cid#1684048 Variable copied when it could be moved cid#1684049 Variable copied when it could be moved cid#1684050 Variable copied when it could be moved Change-Id: I9745b94b2c171c76c760ae406094622702b4d251 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201143 Tested-by: Caolán McNamara <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> diff --git a/sc/source/ui/view/tabvwsha.cxx b/sc/source/ui/view/tabvwsha.cxx index 4024ef519f7a..e2a2ebe382c1 100644 --- a/sc/source/ui/view/tabvwsha.cxx +++ b/sc/source/ui/view/tabvwsha.cxx @@ -1050,7 +1050,8 @@ void ScTabViewShell::ExecStyle( SfxRequest& rReq ) case SID_STYLE_SHOW: case SID_STYLE_NEW_BY_EXAMPLE: { - auto lambda = [pStylePool, nSlotId, xOldData, xNewData, eFamily, this](SfxRequest& rRequest, const OUString& rStyleName) + auto lambda = [pStylePool, nSlotId, xOldData=std::move(xOldData), + xNewData=std::move(xNewData), eFamily, this](SfxRequest& rRequest, const OUString& rStyleName) { SfxStyleSheetBase* pApplyStyleSheet = pStylePool->Find(rStyleName, eFamily); xOldData->InitFromStyle(pApplyStyleSheet); @@ -1070,7 +1071,8 @@ void ScTabViewShell::ExecStyle( SfxRequest& rReq ) auto xDlg = std::make_shared<SfxNewStyleDlg>(pDialogParent, *pStylePool, eFamily); auto xRequest = std::make_shared<SfxRequest>(rReq); rReq.Ignore(); - weld::GenericDialogController::runAsync(xDlg,[xDlg, xRequest, lambda](sal_Int32 nResult){ + weld::GenericDialogController::runAsync(xDlg,[xDlg, xRequest=std::move(xRequest), + lambda=std::move(lambda)](sal_Int32 nResult){ if (nResult == RET_OK) { lambda(*xRequest, xDlg->GetName()); } diff --git a/svx/source/svdraw/svdogrp.cxx b/svx/source/svdraw/svdogrp.cxx index de1fda977380..39d03efbf5f0 100644 --- a/svx/source/svdraw/svdogrp.cxx +++ b/svx/source/svdraw/svdogrp.cxx @@ -842,9 +842,7 @@ void SdrObjGroup::SetDescription(const OUString& rStr) aOrigDescription = OUString::fromUtf8(aDiagramModel.get("origDesc", "")); // parse content to a new Diagram DataModel - std::shared_ptr<svx::diagram::DiagramHelper_svx> aNewHelper(svx::diagram::DiagramHelperFactory_svx::getDiagramHelperFactory_svx().createDiagramHelper_svx(aDiagramModel)); - - mp_DiagramHelper = aNewHelper; + mp_DiagramHelper = svx::diagram::DiagramHelperFactory_svx::getDiagramHelperFactory_svx().createDiagramHelper_svx(aDiagramModel); mp_DiagramHelper->getRootShape() = getUnoShape(); } } commit d81ce666bbda1795a5d4dcb71f37b0be250131db Author: Caolán McNamara <[email protected]> AuthorDate: Thu Mar 5 23:14:53 2026 +0000 Commit: Caolán McNamara <[email protected]> CommitDate: Fri Mar 6 20:08:52 2026 +0100 ofz: Stack-overflow in DelFlyInRange During WW6/WW8 import, the anchor position tracked in the filter stack can drift due to node insertions/deletions. When the computed anchor position lands inside the fly's own content section, it creates a self-referencing cycle that causes infinite recursion in DelFlyInRange. Check after MakePoint that the anchor does not fall inside the fly's own content section before applying the update. Change-Id: I305ffd68551b6d7bcccb5f0dd4b9462223f93d52 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201079 Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Jenkins diff --git a/sw/qa/filter/ww8/data/ofz-delflyinrange-1.doc b/sw/qa/filter/ww8/data/ofz-delflyinrange-1.doc new file mode 100644 index 000000000000..735b259f0c99 Binary files /dev/null and b/sw/qa/filter/ww8/data/ofz-delflyinrange-1.doc differ diff --git a/sw/qa/filter/ww8/ww8.cxx b/sw/qa/filter/ww8/ww8.cxx index e5c3f69b264a..1eb286cb9a41 100644 --- a/sw/qa/filter/ww8/ww8.cxx +++ b/sw/qa/filter/ww8/ww8.cxx @@ -639,6 +639,13 @@ CPPUNIT_TEST_FIXTURE(Test, testContentControlPDFDropDownEmptyItem) assertXPath(pXmlDoc, "//w:dropDownList/w:listItem", 1); } +CPPUNIT_TEST_FIXTURE(Test, testOfzDelflyinrange) +{ + // Without the fix in place, + // loading the document would crash in DelFlyInRange. + createSwDoc("ofz-delflyinrange-1.doc"); +} + CPPUNIT_TEST_FIXTURE(Test, tdf71749_with_footnote) { // Without the fix in place, diff --git a/sw/source/filter/basflt/fltshell.cxx b/sw/source/filter/basflt/fltshell.cxx index bb21ac01bb6a..a4e91df69f60 100644 --- a/sw/source/filter/basflt/fltshell.cxx +++ b/sw/source/filter/basflt/fltshell.cxx @@ -30,6 +30,7 @@ #include <svl/cintitem.hxx> #include <svl/stritem.hxx> #include <fmtanchr.hxx> +#include <fmtcntnt.hxx> #include <fmtfld.hxx> #include <redline.hxx> #include <pam.hxx> @@ -497,6 +498,25 @@ void SwFltControlStack::SetAttrInDoc(const SwPosition& rTmpPos, if (pFormat != nullptr) { MakePoint(rEntry, aRegion); + // Check that the anchor is not inside its own content section, causing infinite + // regress in DelFlyInRange. + const SwNodeIndex* pContentIdx = pFormat->GetContent().GetContentIdx(); + if (pContentIdx && pFormat->Which() == RES_FLYFRMFMT) + { + SwNodeOffset nAnchor = aRegion.GetPoint()->GetNodeIndex(); + SwNodeOffset nContentStart = pContentIdx->GetIndex(); + SwNodeOffset nContentEnd = pContentIdx->GetNode().EndOfSectionNode()->GetIndex(); + if (nAnchor > nContentStart && nAnchor < nContentEnd) + { + SAL_WARN("sw", "fly frame anchored to its own content"); + // Move the PaM out of the fly content before deleting, anywhere else + // will presumably do + aRegion.DeleteMark(); + *aRegion.GetPoint() = rTmpPos; + m_rDoc.getIDocumentLayoutAccess().DelLayoutFormat(pFormat); + break; + } + } SwFormatAnchor aAnchor(pFormat->GetAnchor()); aAnchor.SetAnchor(aRegion.GetPoint()); pFormat->SetFormatAttr(aAnchor);
