fdo#48692: fix problems with large number of table cells:

The SwTableSortBoxes is now a STL container which can have more than
2^16 elements but unfortunately there are a lot of 16 bit integers used
to index it all over the place, causing infinite loops and possibly
worse problems; fix that to use size_t.

Change-Id: I868ec9dd0629be4fbe4d6b8f294fb765e3d662ec

13 files changed, 69 insertions, 50 deletions

diff --git a/sw/inc/swtable.hxx b/sw/inc/swtable.hxx
index 0a887c679918..709fce4bc861 100644
--- a/sw/inc/swtable.hxx
+++ b/sw/inc/swtable.hxx
@@ -106,13 +106,13 @@ class SW_DLLPUBLIC SwTable: public SwClient          //Client of FrmFmt.
 
 protected:
     SwTableLines aLines;
-    SwTableSortBoxes aSortCntBoxes;
+    SwTableSortBoxes m_TabSortContentBoxes;
     SwServerObjectRef refObj;   // In case DataServer -> pointer is set.
 
     SwHTMLTableLayout *pHTMLLayout;
 
     // Usually, the table node of a SwTable can be accessed by getting a box
-    // out of aSortCntBoxes, which know their SwStartNode. But in some rare
+    // out of m_TabSortContentBoxes, which know their SwStartNode. But in some rare
     // cases, we need to know the table node of a SwTable, before the table
     // boxes have been build (SwTableNode::MakeCopy with tables in tables).
     SwTableNode* pTableNode;
@@ -263,8 +263,8 @@ public:
         { _FindSuperfluousRows( rBoxes, 0, 0 ); }
     void CheckRowSpan( SwTableLine* &rpLine, bool bUp ) const;
 
-          SwTableSortBoxes& GetTabSortBoxes()       { return aSortCntBoxes; }
-    const SwTableSortBoxes& GetTabSortBoxes() const { return aSortCntBoxes; }
+          SwTableSortBoxes& GetTabSortBoxes()       { return m_TabSortContentBoxes; }
+    const SwTableSortBoxes& GetTabSortBoxes() const { return m_TabSortContentBoxes; }
 
     // Read 1st number and delete it from string (used by GetTblBox and SwTblFld).
 
@@ -321,7 +321,7 @@ public:
     // Clean up structure a bit.
     void GCLines();
 
-    // Returns the table node via aSortCntBoxes or pTableNode.
+    // Returns the table node via m_TabSortContentBoxes or pTableNode.
     SwTableNode* GetTableNode() const;
     void SetTableNode( SwTableNode* pNode ) { pTableNode = pNode; }
 
diff --git a/sw/inc/unotbl.hxx b/sw/inc/unotbl.hxx
index 3191c0ce2690..7c7f166db0b0 100644
--- a/sw/inc/unotbl.hxx
+++ b/sw/inc/unotbl.hxx
@@ -97,7 +97,8 @@ class SwXCell : public SwXCellBaseClass,
     const SwStartNode*      pStartNode; // only set in XML import
 
     // table position where pBox was found last
-    sal_uInt16              nFndPos;
+    size_t nFndPos;
+    static size_t const NOTFOUND = ::std::numeric_limits<size_t>::max();
 
 protected:
     virtual const SwStartNode *GetStartNode() const;
@@ -115,7 +116,7 @@ protected:
    virtual void Modify( const SfxPoolItem* pOld, const SfxPoolItem *pNew);
 
 public:
-    SwXCell(SwFrmFmt* pTblFmt, SwTableBox* pBox, sal_uInt16 nPos=USHRT_MAX );
+    SwXCell(SwFrmFmt* pTblFmt, SwTableBox* pBox, size_t nPos = NOTFOUND);
     SwXCell(SwFrmFmt* pTblFmt, const SwStartNode& rStartNode); // XML import interface
 
 
diff --git a/sw/source/core/doc/tblrwcl.cxx b/sw/source/core/doc/tblrwcl.cxx
index c043f7b4be38..ef8857f2d173 100644
--- a/sw/source/core/doc/tblrwcl.cxx
+++ b/sw/source/core/doc/tblrwcl.cxx
@@ -708,7 +708,8 @@ void _FndBoxAppendRowLine( SwTableLine* pLine, _FndPara* pFndPara )
 
 sal_Bool SwTable::AppendRow( SwDoc* pDoc, sal_uInt16 nCnt )
 {
-    SwTableNode* pTblNd = (SwTableNode*)aSortCntBoxes[0]->GetSttNd()->FindTableNode();
+    SwTableNode *const pTblNd = const_cast<SwTableNode*>(
+        m_TabSortContentBoxes[0]->GetSttNd()->FindTableNode());
     if( !pTblNd )
         return sal_False;
 
@@ -3663,8 +3664,8 @@ sal_Bool SwTable::SetColWidth( SwTableBox& rAktBox, sal_uInt16 eType,
                 {
                     pFndBox = ::lcl_SaveInsDelData( aParam, ppUndo,
                                                     aTmpLst, nDistStt );
-                    if( aParam.bBigger && aParam.aBoxes.size() ==
-                                    aSortCntBoxes.size() )
+                    if (aParam.bBigger &&
+                        aParam.aBoxes.size() == m_TabSortContentBoxes.size())
                     {
                         // This whole Table is to be deleted!
                         GetFrmFmt()->GetDoc()->DeleteRowCol( aParam.aBoxes );
@@ -4366,7 +4367,7 @@ sal_Bool SwTable::SetRowHeight( SwTableBox& rAktBox, sal_uInt16 eType,
 
                         // delete complete table when last row is deleted
                         if( !bBigger &&
-                            aParam.aBoxes.size() == aSortCntBoxes.size() )
+                            aParam.aBoxes.size() == m_TabSortContentBoxes.size())
                         {
                             GetFrmFmt()->GetDoc()->DeleteRowCol( aParam.aBoxes );
                             return sal_False;
diff --git a/sw/source/core/docnode/ndcopy.cxx b/sw/source/core/docnode/ndcopy.cxx
index c15e6fc71c35..d8b448ed2a41 100644
--- a/sw/source/core/docnode/ndcopy.cxx
+++ b/sw/source/core/docnode/ndcopy.cxx
@@ -473,7 +473,7 @@ SwTableNode* SwTableNode::MakeCopy( SwDoc* pDoc, const SwNodeIndex& rIdx ) const
     // does not seem to be used, because the table does not have any contents yet
     // (see IsUsed). Therefore the inner table gets the same name as the outer table.
     // We have to make sure that the table node of the SwTable is accessible, even
-    // without any content in aSortCntBoxes. #i26629#
+    // without any content in m_TabSortContentBoxes. #i26629#
     pTblNd->GetTable().SetTableNode( pTblNd );
     rNds._Copy( aRg, aInsPos, sal_False );
     pTblNd->GetTable().SetTableNode( 0 );
diff --git a/sw/source/core/docnode/ndsect.cxx b/sw/source/core/docnode/ndsect.cxx
index 81d495a2e2ff..2197ca6d5931 100644
--- a/sw/source/core/docnode/ndsect.cxx
+++ b/sw/source/core/docnode/ndsect.cxx
@@ -121,7 +121,7 @@ bool lcl_IsInSameTblBox( SwNodes& _rNds,
     // dann suche den StartNode der Box
     const SwTableSortBoxes& rSortBoxes = pTblNd->GetTable().GetTabSortBoxes();
     sal_uLong nIdx = _rNd.GetIndex();
-    for( sal_uInt16 n = 0; n < rSortBoxes.size(); ++n )
+    for (size_t n = 0; n < rSortBoxes.size(); ++n)
     {
         const SwStartNode* pNd = rSortBoxes[ n ]->GetSttNd();
         if ( pNd->GetIndex() < nIdx && nIdx < pNd->EndOfSectionIndex() )
diff --git a/sw/source/core/docnode/ndtbl.cxx b/sw/source/core/docnode/ndtbl.cxx
index 944e92011bfc..f334b7b2b59f 100644
--- a/sw/source/core/docnode/ndtbl.cxx
+++ b/sw/source/core/docnode/ndtbl.cxx
@@ -862,8 +862,10 @@ const SwTable* SwDoc::TextToTable( const SwInsertTableOptions& rInsTblOpts,
     // JP 03.04.97: Inhalt der Boxen auf Zahlen abpruefen
     if( IsInsTblFormatNum() )
     {
-        for( sal_uInt16 nBoxes = pNdTbl->GetTabSortBoxes().size(); nBoxes; )
+        for (size_t nBoxes = pNdTbl->GetTabSortBoxes().size(); nBoxes; )
+        {
             ChkBoxNumFmt( *pNdTbl->GetTabSortBoxes()[ --nBoxes ], sal_False );
+        }
     }
 
     sal_uLong nIdx = pTblNd->GetIndex();
@@ -4420,7 +4422,7 @@ sal_Bool SwDoc::_UnProtectTblCells( SwTable& rTbl )
         :   0;
 
     SwTableSortBoxes& rSrtBox = rTbl.GetTabSortBoxes();
-    for( sal_uInt16 i = rSrtBox.size(); i; )
+    for (size_t i = rSrtBox.size(); i; )
     {
         SwFrmFmt *pBoxFmt = rSrtBox[ --i ]->GetFrmFmt();
         if( pBoxFmt->GetProtect().IsCntntProtected() )
@@ -4561,7 +4563,7 @@ sal_Bool SwDoc::HasTblAnyProtection( const SwPosition* pPos,
     if( pTbl )
     {
         SwTableSortBoxes& rSrtBox = pTbl->GetTabSortBoxes();
-        for( sal_uInt16 i = rSrtBox.size(); i; )
+        for (size_t i = rSrtBox.size(); i; )
         {
             SwFrmFmt *pBoxFmt = rSrtBox[ --i ]->GetFrmFmt();
             if( pBoxFmt->GetProtect().IsCntntProtected() )
diff --git a/sw/source/core/fields/ddetbl.cxx b/sw/source/core/fields/ddetbl.cxx
index 54f1642fa9f4..73c30ea3554e 100644
--- a/sw/source/core/fields/ddetbl.cxx
+++ b/sw/source/core/fields/ddetbl.cxx
@@ -49,7 +49,7 @@ SwDDETable::SwDDETable( SwTable& rTable, SwDDEFieldType* pDDEType,
     : SwTable( rTable ), aDepend( this, pDDEType )
 {
     // Kopiere/move die Daten der Tabelle
-    aSortCntBoxes.insert( rTable.GetTabSortBoxes()  ); // move die Inh. Boxen
+    m_TabSortContentBoxes.insert(rTable.GetTabSortBoxes());
     rTable.GetTabSortBoxes().clear();
 
     aLines.insert( aLines.begin(),
diff --git a/sw/source/core/frmedt/fetab.cxx b/sw/source/core/frmedt/fetab.cxx
index 8e04d6e75f1c..5e5b13712f66 100644
--- a/sw/source/core/frmedt/fetab.cxx
+++ b/sw/source/core/frmedt/fetab.cxx
@@ -1276,7 +1276,7 @@ sal_Bool SwFEShell::SetTableAutoFmt( const SwTableAutoFmt& rNew )
     else
     {
         const SwTableSortBoxes& rTBoxes = pTblNd->GetTable().GetTabSortBoxes();
-        for( sal_uInt16 n = 0; n < rTBoxes.size(); ++n )
+        for (size_t n = 0; n < rTBoxes.size(); ++n)
         {
             SwTableBox* pBox = rTBoxes[ n ];
             aBoxes.insert( pBox );
@@ -1315,7 +1315,7 @@ sal_Bool SwFEShell::GetTableAutoFmt( SwTableAutoFmt& rGet )
     else
     {
         const SwTableSortBoxes& rTBoxes = pTblNd->GetTable().GetTabSortBoxes();
-        for( sal_uInt16 n = 0; n < rTBoxes.size(); ++n )
+        for (size_t n = 0; n < rTBoxes.size(); ++n)
         {
             SwTableBox* pBox = rTBoxes[ n ];
             aBoxes.insert( pBox );
diff --git a/sw/source/core/table/swtable.cxx b/sw/source/core/table/swtable.cxx
index 5784ada575c9..5310ae2e0efb 100644
--- a/sw/source/core/table/swtable.cxx
+++ b/sw/source/core/table/swtable.cxx
@@ -281,8 +281,10 @@ SwTable::SwTable( const SwTable& rTable )
 
 void DelBoxNode( SwTableSortBoxes& rSortCntBoxes )
 {
-    for( sal_uInt16 n = 0; n < rSortCntBoxes.size(); ++n )
+    for (size_t n = 0; n < rSortCntBoxes.size(); ++n)
+    {
         rSortCntBoxes[ n ]->pSttNd = 0;
+    }
 }
 
 SwTable::~SwTable()
@@ -307,8 +309,8 @@ SwTable::~SwTable()
     // are preserved and are deleted by the lines/boxes arrays dtor.
     // Note: unfortunately not enough, pointers to the StartNode of the
     // section need deletion.
-    DelBoxNode( aSortCntBoxes );
-    aSortCntBoxes.clear();
+    DelBoxNode(m_TabSortContentBoxes);
+    m_TabSortContentBoxes.clear();
     delete pHTMLLayout;
 }
 
@@ -1502,9 +1504,13 @@ SwTableBox* SwTable::GetTblBox( sal_uLong nSttIdx )
     // In case the layout doesn't exist yet or anything else goes wrong.
     if ( !pRet )
     {
-        for( sal_uInt16 n = aSortCntBoxes.size(); n; )
-            if( aSortCntBoxes[ --n ]->GetSttIdx() == nSttIdx )
-                return aSortCntBoxes[ n ];
+        for (size_t n = m_TabSortContentBoxes.size(); n; )
+        {
+            if (m_TabSortContentBoxes[ --n ]->GetSttIdx() == nSttIdx)
+            {
+                return m_TabSortContentBoxes[ n ];
+            }
+        }
     }
     return pRet;
 }
@@ -1514,9 +1520,13 @@ sal_Bool SwTable::IsTblComplex() const
     // Returns sal_True for complex tables, i.e. tables that contain nestings,
     // like containing boxes not part of the first line, e.g. results of
     // splits/merges which lead to more complex structures.
-    for( sal_uInt16 n = 0; n < aSortCntBoxes.size(); ++n )
-        if( aSortCntBoxes[ n ]->GetUpper()->GetUpper() )
+    for (size_t n = 0; n < m_TabSortContentBoxes.size(); ++n)
+    {
+        if (m_TabSortContentBoxes[ n ]->GetUpper()->GetUpper())
+        {
             return sal_True;
+        }
+    }
     return sal_False;
 }
 
@@ -1950,9 +1960,9 @@ sal_Bool SwTable::GetInfo( SfxPoolItem& rInfo ) const
         const SwTableNode* pTblNode = GetTableNode();
         if( pTblNode && &pTblNode->GetNodes() == ((SwAutoFmtGetDocNode&)rInfo).pNodes )
         {
-            if ( !aSortCntBoxes.empty() )
+            if (!m_TabSortContentBoxes.empty())
             {
-                  SwNodeIndex aIdx( *aSortCntBoxes[ 0 ]->GetSttNd() );
+                SwNodeIndex aIdx( *m_TabSortContentBoxes[0]->GetSttNd() );
                 ((SwAutoFmtGetDocNode&)rInfo).pCntntNode =
                                 GetFrmFmt()->GetDoc()->GetNodes().GoNext( &aIdx );
             }
@@ -1963,10 +1973,10 @@ sal_Bool SwTable::GetInfo( SfxPoolItem& rInfo ) const
     case RES_FINDNEARESTNODE:
         if( GetFrmFmt() && ((SwFmtPageDesc&)GetFrmFmt()->GetFmtAttr(
             RES_PAGEDESC )).GetPageDesc() &&
-            !aSortCntBoxes.empty() &&
-            aSortCntBoxes[ 0 ]->GetSttNd()->GetNodes().IsDocNodes() )
-            ((SwFindNearestNode&)rInfo).CheckNode( *
-                aSortCntBoxes[ 0 ]->GetSttNd()->FindTableNode() );
+            !m_TabSortContentBoxes.empty() &&
+            m_TabSortContentBoxes[0]->GetSttNd()->GetNodes().IsDocNodes() )
+            static_cast<SwFindNearestNode&>(rInfo).CheckNode( *
+                m_TabSortContentBoxes[0]->GetSttNd()->FindTableNode() );
         break;
 
     case RES_CONTENT_VISIBLE:
diff --git a/sw/source/core/undo/untbl.cxx b/sw/source/core/undo/untbl.cxx
index e5e4f0b2ac50..bd6c6cd8eee2 100644
--- a/sw/source/core/undo/untbl.cxx
+++ b/sw/source/core/undo/untbl.cxx
@@ -493,8 +493,10 @@ void SwUndoTblToTxt::UndoImpl(::sw::UndoRedoContext & rContext)
     if( bCheckNumFmt )
     {
         SwTableSortBoxes& rBxs = pTblNd->GetTable().GetTabSortBoxes();
-        for( sal_uInt16 nBoxes = rBxs.size(); nBoxes; )
+        for (size_t nBoxes = rBxs.size(); nBoxes; )
+        {
             rDoc.ChkBoxNumFmt( *rBxs[ --nBoxes ], sal_False );
+        }
     }
 
     if( pHistory )
@@ -1539,13 +1541,12 @@ void SwUndoTblNdsChg::SaveNewBoxes( const SwTableNode& rTblNd,
 {
     const SwTable& rTbl = rTblNd.GetTable();
     const SwTableSortBoxes& rTblBoxes = rTbl.GetTabSortBoxes();
-    sal_uInt16 n;
-    sal_uInt16 i;
 
     OSL_ENSURE( ! IsDelBox(), "wrong Action" );
     pNewSttNds.reset( new std::set<_BoxMove> );
 
-    for( n = 0, i = 0; n < rOld.size(); ++i )
+    size_t i = 0;
+    for (size_t  n = 0; n < rOld.size(); ++i)
     {
         if( rOld[ n ] == rTblBoxes[ i ] )
             ++n;
@@ -1599,7 +1600,7 @@ void SwUndoTblNdsChg::SaveNewBoxes( const SwTableNode& rTblNd,
     OSL_ENSURE( rTbl.IsNewModel() || rOld.size() + nCount * rBoxes.size() == rTblBoxes.size(),
         "unexpected boxes" );
     OSL_ENSURE( rOld.size() <= rTblBoxes.size(), "more unexpected boxes" );
-    for( sal_uInt16 n = 0, i = 0; i < rTblBoxes.size(); ++i )
+    for (size_t n = 0, i = 0; i < rTblBoxes.size(); ++i)
     {
         if( ( n < rOld.size() ) &&
             ( rOld[ n ] == rTblBoxes[ i ] ) )
@@ -1726,8 +1727,9 @@ void SwUndoTblNdsChg::UndoImpl(::sw::UndoRedoContext & rContext)
         std::vector<_BoxMove> aTmp( pNewSttNds->begin(), pNewSttNds->end() );
 
         // backwards
-        for( int n = aTmp.size() - 1; n >= 0 ; --n)
+        for (size_t n = aTmp.size(); n > 0 ; )
         {
+            --n;
             // delete box from table structure
             sal_uLong nIdx = aTmp[n].index;
             SwTableBox* pBox = pTblNd->GetTable().GetTblBox( nIdx );
@@ -1746,7 +1748,7 @@ void SwUndoTblNdsChg::UndoImpl(::sw::UndoRedoContext & rContext)
                 SwNodeIndex aInsPos( *(pLine->GetTabBoxes()[0]->GetSttNd()), 2 );
 
                 // adjust all StartNode indices
-                sal_uInt16 i = n;
+                size_t i = n;
                 sal_uLong nSttIdx = aInsPos.GetIndex() - 2,
                        nNdCnt = aRg.aEnd.GetIndex() - aRg.aStart.GetIndex();
                 while( i && aTmp[ --i ].index > nSttIdx )
@@ -3108,7 +3110,7 @@ void CheckTable( const SwTable& rTbl )
 {
     const SwNodes& rNds = rTbl.GetFrmFmt()->GetDoc()->GetNodes();
     const SwTableSortBoxes& rSrtArr = rTbl.GetTabSortBoxes();
-    for( sal_uInt16 n = 0; n < rSrtArr.size(); ++n )
+    for (size_t n = 0; n < rSrtArr.size(); ++n)
     {
         const SwTableBox* pBox = rSrtArr[ n ];
         const SwNode* pNd = pBox->GetSttNd();
diff --git a/sw/source/core/unocore/unotbl.cxx b/sw/source/core/unocore/unotbl.cxx
index 7b9dc1b7c71a..64eba7af4ced 100644
--- a/sw/source/core/unocore/unotbl.cxx
+++ b/sw/source/core/unocore/unotbl.cxx
@@ -740,7 +740,7 @@ void lcl_setValue( SwXCell &rCell, double nVal )
  ******************************************************************/
 TYPEINIT1(SwXCell, SwClient);
 
-SwXCell::SwXCell(SwFrmFmt* pTblFmt, SwTableBox* pBx, sal_uInt16 nPos ) :
+SwXCell::SwXCell(SwFrmFmt* pTblFmt, SwTableBox* pBx, size_t const nPos) :
     SwXText(pTblFmt->GetDoc(), CURSOR_TBLTEXT),
     SwClient(pTblFmt),
     m_pPropSet(aSwMapProvider.GetPropertySet(PROPERTY_MAP_TABLE_CELL)),
@@ -756,7 +756,7 @@ SwXCell::SwXCell(SwFrmFmt* pTblFmt, const SwStartNode& rStartNode) :
     m_pPropSet(aSwMapProvider.GetPropertySet(PROPERTY_MAP_TABLE_CELL)),
     pBox(0),
     pStartNode(&rStartNode),
-    nFndPos(USHRT_MAX)
+    nFndPos(NOTFOUND)
 {
 }
 
@@ -1214,7 +1214,7 @@ SwXCell* SwXCell::CreateXCell(SwFrmFmt* pTblFmt, SwTableBox* pBox, SwTable *pTab
         //wenn es die Box gibt, dann wird auch eine Zelle zurueckgegeben
         if( it != pTable->GetTabSortBoxes().end() )
         {
-            sal_uInt16 nPos = it - pTable->GetTabSortBoxes().begin();
+            size_t const nPos = it - pTable->GetTabSortBoxes().begin();
             SwIterator<SwXCell,SwFmt> aIter( *pTblFmt );
             SwXCell* pXCell = aIter.First();
             while( pXCell )
@@ -1226,7 +1226,9 @@ SwXCell* SwXCell::CreateXCell(SwFrmFmt* pTblFmt, SwTableBox* pBox, SwTable *pTab
             }
             //sonst anlegen
             if(!pXCell)
-                pXCell = new SwXCell(pTblFmt, pBox, nPos );
+            {
+                pXCell = new SwXCell(pTblFmt, pBox, nPos);
+            }
             pRet = pXCell;
         }
     }
@@ -1250,7 +1252,7 @@ SwTableBox* SwXCell::FindBox(SwTable* pTable, SwTableBox* pBox2)
     }
 
     // box not found: reset nFndPos pointer
-    nFndPos = USHRT_MAX;
+    nFndPos = NOTFOUND;
     return 0;
 }
 
@@ -2931,7 +2933,7 @@ void SwXTextTable::sort(const uno::Sequence< beans::PropertyValue >& rDescriptor
         SwTable* pTable = SwTable::FindTable( pFmt );
         SwSelBoxes aBoxes;
         const SwTableSortBoxes& rTBoxes = pTable->GetTabSortBoxes();
-        for( sal_uInt16 n = 0; n < rTBoxes.size(); ++n )
+        for (size_t n = 0; n < rTBoxes.size(); ++n)
         {
             SwTableBox* pBox = rTBoxes[ n ];
             aBoxes.insert( pBox );
@@ -2959,7 +2961,7 @@ void SwXTextTable::autoFormat(const OUString& aName) throw( lang::IllegalArgumen
                 {
                     SwSelBoxes aBoxes;
                     const SwTableSortBoxes& rTBoxes = pTable->GetTabSortBoxes();
-                    for( sal_uInt16 n = 0; n < rTBoxes.size(); ++n )
+                    for (size_t n = 0; n < rTBoxes.size(); ++n)
                     {
                         SwTableBox* pBox = rTBoxes[ n ];
                         aBoxes.insert( pBox );
diff --git a/sw/source/filter/html/htmltab.cxx b/sw/source/filter/html/htmltab.cxx
index d7e117da8d0e..ae4e4feeec42 100644
--- a/sw/source/filter/html/htmltab.cxx
+++ b/sw/source/filter/html/htmltab.cxx
@@ -5463,7 +5463,8 @@ HTMLTable *SwHTMLParser::BuildTable( SvxAdjust eParentAdjust,
             bUpperSpace = sal_True;
             SetTxtCollAttrs();
 
-            nParaCnt = nParaCnt - Min(nParaCnt, (sal_uInt16)pTCntxt->GetTableNode()->GetTable().GetTabSortBoxes().size());
+            nParaCnt = nParaCnt - std::min(nParaCnt,
+                pTCntxt->GetTableNode()->GetTable().GetTabSortBoxes().size());
 
             // ggfs. eine Tabelle anspringen
             if( JUMPTO_TABLE == eJumpTo && pTable->GetSwTable() &&
diff --git a/sw/source/filter/html/swhtml.hxx b/sw/source/filter/html/swhtml.hxx
index efdd279e573b..c9289ef12b97 100644
--- a/sw/source/filter/html/swhtml.hxx
+++ b/sw/source/filter/html/swhtml.hxx
@@ -422,7 +422,7 @@ class SwHTMLParser : public SfxHTMLParser, public SwClient
     sal_uInt16  nFontStHeadStart;   // Elemente im Font-Stack bei <Hn>
     sal_uInt16  nSBModuleCnt;       // Zaehler fuer Basic-Module
     sal_uInt16  nMissingImgMaps;    // Wie viele Image-Maps fehlen noch?
-    sal_uInt16  nParaCnt;
+    size_t nParaCnt;
     sal_uInt16  nContextStMin;      // Untergrenze fuer PopContext
     sal_uInt16  nContextStAttrMin;  // Untergrenze fuer Attributierung
     sal_uInt16  nSelectEntryCnt;    // Anzahl der Eintraege der akt. Listbox