diff options
| author | Michael Stahl <mstahl@redhat.com> | 2015-04-02 23:33:41 +0200 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2015-04-02 23:53:30 +0200 |
| commit | b24a15a0aaea310806259eaa20a7d509ce30e5c8 (patch) | |
| tree | 82973e0fc19a36ac5848d55315fffca067127796 | |
| parent | 41e4998cdeb54a6fc316f349de61296be820fe47 (diff) | |
sw: fix crash on SwUndoDelete after select-all with table at start
Somehow the Redo leaves the shell cursor at an invalid offset into the
paragraph, which then leads to out-of-bounds string access.
Noticed that SwUndRng::SetPaM() leaves an invalid nContent.m_nIndex on
the start position, due to a surprising omission in SwIndex::ChgValue().
(regression from 555ff26501d1bbd8a7872c20671c6303db1e1701)
Change-Id: I6e6ad7f70835d7e9d6da1fb680e2ae15469fad71
| -rw-r--r-- | sw/source/core/bastyp/index.cxx | 1 | ||||
| -rw-r--r-- | sw/source/core/edit/eddel.cxx | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/sw/source/core/bastyp/index.cxx b/sw/source/core/bastyp/index.cxx index d77e23961d6a..dc5041f3c514 100644 --- a/sw/source/core/bastyp/index.cxx +++ b/sw/source/core/bastyp/index.cxx @@ -81,6 +81,7 @@ SwIndex& SwIndex::ChgValue( const SwIndex& rIdx, sal_Int32 nNewValue ) assert(m_pIndexReg == rIdx.m_pIndexReg); if (!m_pIndexReg) { + m_nIndex = 0; return *this; // no IndexReg => no list to sort into; m_nIndex is 0 } SwIndex* pFnd = const_cast<SwIndex*>(&rIdx); diff --git a/sw/source/core/edit/eddel.cxx b/sw/source/core/edit/eddel.cxx index 313d079856fb..b5f2db961c2e 100644 --- a/sw/source/core/edit/eddel.cxx +++ b/sw/source/core/edit/eddel.cxx @@ -99,6 +99,7 @@ void SwEditShell::DeleteSel( SwPaM& rPam, bool* pUndo ) // Selection starts at the first para of the first cell, but we // want to delete the table node before the first cell as well. pNewPam->Start()->nNode = pNewPam->Start()->nNode.GetNode().FindTableNode()->GetIndex(); + pNewPam->Start()->nContent.Assign(nullptr, 0); pPam = pNewPam.get(); } // delete everything |