diff options
| author | Miklos Vajna <vmiklos@collabora.co.uk> | 2013-12-27 20:46:50 +0100 |
|---|---|---|
| committer | Miklos Vajna <vmiklos@collabora.co.uk> | 2013-12-27 21:24:54 +0100 |
| commit | bb562304c1e1c61a882e6db65806cfdf8601bcbf (patch) | |
| tree | cb2a70eb104539b00d43e7caa7d4caf220979001 /sw | |
| parent | acf3949da96d678239e83df5b47c2f20014ca71f (diff) | |
Related: fdo#65090 Fix crash in SwXTextTableCursor::mergeRange()
Regression from b844f06b36cf9a6c1411861a08701c8f9be2af0d (fdo#48692: fix
problems with large number of table cells, 2012-09-21), the problem was
that GetSelectedBoxesCount() may return 0, and if that happens, the
prefix decrement operator set nCount to 0xffffffffffffffff, which then
resulted in a call to DeleteBox(), which did not happen before.
Thanks debug STL for pointing out this issue.
Change-Id: I9eee55f642726343c4ce9af479ccd2c4dde03b6a
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/core/unocore/unotbl.cxx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sw/source/core/unocore/unotbl.cxx b/sw/source/core/unocore/unotbl.cxx index fad3242bde65..9702a50dfb59 100644 --- a/sw/source/core/unocore/unotbl.cxx +++ b/sw/source/core/unocore/unotbl.cxx @@ -1720,7 +1720,7 @@ sal_Bool SwXTextTableCursor::mergeRange(void) throw( uno::RuntimeException ) if(bRet) { size_t nCount = pTblCrsr->GetSelectedBoxesCount(); - while (--nCount) + while (nCount--) { pTblCrsr->DeleteBox(nCount); } |