summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMiklos Vajna <vmiklos@collabora.co.uk>2013-12-27 20:46:50 +0100
committerMiklos Vajna <vmiklos@collabora.co.uk>2013-12-27 21:24:54 +0100
commitbb562304c1e1c61a882e6db65806cfdf8601bcbf (patch)
treecb2a70eb104539b00d43e7caa7d4caf220979001
parentacf3949da96d678239e83df5b47c2f20014ca71f (diff)
Related: fdo#65090 Fix crash in SwXTextTableCursor::mergeRange()
Regression from b844f06b36cf9a6c1411861a08701c8f9be2af0d (fdo#48692: fix problems with large number of table cells, 2012-09-21), the problem was that GetSelectedBoxesCount() may return 0, and if that happens, the prefix decrement operator set nCount to 0xffffffffffffffff, which then resulted in a call to DeleteBox(), which did not happen before. Thanks debug STL for pointing out this issue. Change-Id: I9eee55f642726343c4ce9af479ccd2c4dde03b6a
-rw-r--r--sw/source/core/unocore/unotbl.cxx2
1 files changed, 1 insertions, 1 deletions
diff --git a/sw/source/core/unocore/unotbl.cxx b/sw/source/core/unocore/unotbl.cxx
index fad3242bde65..9702a50dfb59 100644
--- a/sw/source/core/unocore/unotbl.cxx
+++ b/sw/source/core/unocore/unotbl.cxx
@@ -1720,7 +1720,7 @@ sal_Bool SwXTextTableCursor::mergeRange(void) throw( uno::RuntimeException )
if(bRet)
{
size_t nCount = pTblCrsr->GetSelectedBoxesCount();
- while (--nCount)
+ while (nCount--)
{
pTblCrsr->DeleteBox(nCount);
}