summaryrefslogtreecommitdiff
path: root/sw/source/core/doc/DocumentContentOperationsManager.cxx
diff options
context:
space:
mode:
authorEike Rathke <erack@redhat.com>2017-08-21 15:49:41 +0200
committerChristian Lohmaier <lohmaier+LibreOffice@googlemail.com>2017-08-22 19:48:26 +0200
commit8d8044d25a6d112854655ef0ad51f1a904350f0f (patch)
tree080ab1442931b01c1e2f6fdd109c02cf18a9fb2c /sw/source/core/doc/DocumentContentOperationsManager.cxx
parent067746290351c62b502425713360019a9863519a (diff)
Resolves: tdf#111943 really really limit the match, tdf#108292 follow-up
getRemainingCount() could deliver a wrapped around overflow value if mnIndex was already greater than the end index, which could happen if when/for non-matching larger block sizes were added, and if then a match was found behind those blocks a non-requested/unexpected index was returned, which in turn led to the assert() being hit in ScInterpreter::CalculateLookup(). In non-debug could result in an invalid block position access. This happened with the bug case document of tdf#111943 which in master can be loaded. Also, the start and end index are not dynamic and don't have to be recalculated each time, so make them const; column argument values are unused after. (cherry picked from commit 25b3806ac509006573e669acc33643af3bd77380) Change-Id: Ic294cade4e8e7828bee394e5ade61d7127be6bbb Reviewed-on: https://gerrit.libreoffice.org/41397 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Diffstat (limited to 'sw/source/core/doc/DocumentContentOperationsManager.cxx')
0 files changed, 0 insertions, 0 deletions