summaryrefslogtreecommitdiff
path: root/sd
diff options
context:
space:
mode:
Diffstat (limited to 'sd')
-rw-r--r--sd/source/ui/dlg/animobjs.cxx10
1 files changed, 6 insertions, 4 deletions
diff --git a/sd/source/ui/dlg/animobjs.cxx b/sd/source/ui/dlg/animobjs.cxx
index c2d83e45f548..2c2f4ee13183 100644
--- a/sd/source/ui/dlg/animobjs.cxx
+++ b/sd/source/ui/dlg/animobjs.cxx
@@ -420,7 +420,8 @@ IMPL_LINK_TYPED( AnimationWindow, ClickRemoveBitmapHdl, Button*, pBtn, void )
SdPage* pPage = pMyDoc->GetSdPage(0, PK_STANDARD);
SdrObject* pObject;
- if (pBtn == m_pBtnRemoveBitmap)
+ // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access
+ if (pBtn == m_pBtnRemoveBitmap && EMPTY_FRAMELIST != m_nCurrentFrame)
{
delete m_FrameList[m_nCurrentFrame].first;
delete m_FrameList[m_nCurrentFrame].second;
@@ -439,8 +440,8 @@ IMPL_LINK_TYPED( AnimationWindow, ClickRemoveBitmapHdl, Button*, pBtn, void )
if (m_nCurrentFrame >= m_FrameList.size())
{
- assert(m_FrameList.empty());
- m_nCurrentFrame = EMPTY_FRAMELIST;
+ // tdf#95298 last frame was deleted, try to use the one before it or go on empty state
+ m_nCurrentFrame = m_FrameList.empty() ? EMPTY_FRAMELIST : m_FrameList.size() - 1;
}
}
else // delete everything
@@ -522,7 +523,8 @@ IMPL_LINK_NOARG_TYPED(AnimationWindow, ModifyTimeHdl, Edit&, void)
void AnimationWindow::UpdateControl(bool const bDisableCtrls)
{
- if (!m_FrameList.empty())
+ // tdf#95298 check m_nCurrentFrame for EMPTY_FRAMELIST to avoid out-of-bound array access
+ if (!m_FrameList.empty() && EMPTY_FRAMELIST != m_nCurrentFrame)
{
BitmapEx aBmp(*m_FrameList[m_nCurrentFrame].first);