fdo#40831: SwCursor::RestoreSavePos:

Check that position is valid, so the cursor does not point to a
non-existent node.

1 files changed, 14 insertions, 2 deletions

diff --git a/sw/source/core/crsr/swcrsr.cxx b/sw/source/core/crsr/swcrsr.cxx
index a6fea0d76a54..7340ccc1545a 100644
--- a/sw/source/core/crsr/swcrsr.cxx
+++ b/sw/source/core/crsr/swcrsr.cxx
@@ -2093,10 +2093,22 @@ sal_Bool SwCursor::MoveSection( SwWhichSection fnWhichSect,
 
 void SwCursor::RestoreSavePos()
 {
-    if( pSavePos )
+    // fdo#40831 if you delete the row or column containing pSavePos,
+    // Writer will crash. Work around this.
+    sal_uLong uNodeCount = GetPoint()->nNode.GetNodes().Count();
+    if( pSavePos && pSavePos->nNode < uNodeCount )
     {
         GetPoint()->nNode = pSavePos->nNode;
-        GetPoint()->nContent.Assign( GetCntntNode(), pSavePos->nCntnt );
+
+        xub_StrLen nIdx = 0;
+        if ( GetCntntNode() )
+            if ( pSavePos->nCntnt <= GetCntntNode()->Len() )
+                nIdx = pSavePos->nCntnt;
+            else
+                nIdx = GetCntntNode()->Len();
+        else
+            nIdx = GetPoint()->nContent.GetIndex(); // Probably, nIdx = 0
+        GetPoint()->nContent.Assign( GetCntntNode(), nIdx );
     }
 }