diff options
Diffstat (limited to 'sd/source/ui/dlg/animobjs.cxx')
| -rw-r--r-- | sd/source/ui/dlg/animobjs.cxx | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/sd/source/ui/dlg/animobjs.cxx b/sd/source/ui/dlg/animobjs.cxx index c2d83e45f548..2c2f4ee13183 100644 --- a/sd/source/ui/dlg/animobjs.cxx +++ b/sd/source/ui/dlg/animobjs.cxx @@ -420,7 +420,8 @@ IMPL_LINK_TYPED( AnimationWindow, ClickRemoveBitmapHdl, Button*, pBtn, void ) SdPage* pPage = pMyDoc->GetSdPage(0, PK_STANDARD); SdrObject* pObject; - if (pBtn == m_pBtnRemoveBitmap) + // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access + if (pBtn == m_pBtnRemoveBitmap && EMPTY_FRAMELIST != m_nCurrentFrame) { delete m_FrameList[m_nCurrentFrame].first; delete m_FrameList[m_nCurrentFrame].second; @@ -439,8 +440,8 @@ IMPL_LINK_TYPED( AnimationWindow, ClickRemoveBitmapHdl, Button*, pBtn, void ) if (m_nCurrentFrame >= m_FrameList.size()) { - assert(m_FrameList.empty()); - m_nCurrentFrame = EMPTY_FRAMELIST; + // tdf#95298 last frame was deleted, try to use the one before it or go on empty state + m_nCurrentFrame = m_FrameList.empty() ? EMPTY_FRAMELIST : m_FrameList.size() - 1; } } else // delete everything @@ -522,7 +523,8 @@ IMPL_LINK_NOARG_TYPED(AnimationWindow, ModifyTimeHdl, Edit&, void) void AnimationWindow::UpdateControl(bool const bDisableCtrls) { - if (!m_FrameList.empty()) + // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access + if (!m_FrameList.empty() && EMPTY_FRAMELIST != m_nCurrentFrame) { BitmapEx aBmp(*m_FrameList[m_nCurrentFrame].first); |