forcepoint#72 negative string index

The problem is that the pMaster->GetFormatted() screws up the offset of
the follow frame; there isn't any hope of fixing this up when it happens
so deep inside Format_()... so instead try a conservative check on the
outside (can't check the position there as Format_ moves around quite a
bit) and format the master there already, and then SetOfst() to fix
things.

Change-Id: I0a119ccf1561ece031cec03db3c36155f271a6a8
Reviewed-on: https://gerrit.libreoffice.org/58726
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

3 files changed, 31 insertions, 3 deletions

diff --git a/sw/qa/extras/layout/data/forcepoint72-1.rtf b/sw/qa/extras/layout/data/forcepoint72-1.rtf
new file mode 100644
index 000000000000..ad11b45a4551
--- /dev/null
+++ b/sw/qa/extras/layout/data/forcepoint72-1.rtf
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index 9bf7affcfd87..2ad2814436f8 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -33,6 +33,7 @@ public:
     void testTdf109077();
     void testUserFieldTypeLanguage();
     void testTdf109137();
+    void testForcepoint72();
 
     CPPUNIT_TEST_SUITE(SwLayoutWriter);
     CPPUNIT_TEST(testTdf116830);
@@ -48,6 +49,7 @@ public:
     CPPUNIT_TEST(testTdf109077);
     CPPUNIT_TEST(testUserFieldTypeLanguage);
     CPPUNIT_TEST(testTdf109137);
+    CPPUNIT_TEST(testForcepoint72);
     CPPUNIT_TEST_SUITE_END();
 
 private:
@@ -294,6 +296,9 @@ void SwLayoutWriter::testTdf109137()
                 /*nNumberOfNodes=*/1);
 }
 
+//just care it doesn't crash
+void SwLayoutWriter::testForcepoint72() { createDoc("forcepoint72-1.rtf"); }
+
 CPPUNIT_TEST_SUITE_REGISTRATION(SwLayoutWriter);
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/core/text/frmform.cxx b/sw/source/core/text/frmform.cxx
index c0d2ca2b413c..2c9424bd6529 100644
--- a/sw/source/core/text/frmform.cxx
+++ b/sw/source/core/text/frmform.cxx
@@ -1460,11 +1460,9 @@ void SwTextFrame::Format_( SwTextFormatter &rLine, SwTextFormatInfo &rInf,
         const SwLineLayout* pLine=nullptr;
         if (pMaster)
         {
-            if( !pMaster->HasPara() )
-                pMaster->GetFormatted();
             if (!pMaster->HasPara())
             {   // master could be locked because it's being formatted upstack
-                SAL_WARN("sw", "SwTextFrame::Format_: failed to format master!");
+                SAL_WARN("sw", "SwTextFrame::Format_: master not formatted!");
             }
             else
             {
@@ -1472,6 +1470,7 @@ void SwTextFrame::Format_( SwTextFormatter &rLine, SwTextFormatInfo &rInf,
                 SwTextIter aMasterLine( pMaster, &aInf );
                 aMasterLine.Bottom();
                 pLine = aMasterLine.GetCurr();
+                assert(aMasterLine.GetEnd() == GetOfst());
             }
         }
         SwLinePortion* pRest = pLine ?
@@ -1837,6 +1836,30 @@ void SwTextFrame::Format( vcl::RenderContext* pRenderContext, const SwBorderAttr
 
         // We do not want to be interrupted during formatting
         TextFrameLockGuard aLock(this);
+
+        // this is to ensure that the similar code in SwTextFrame::Format_
+        // finds the master formatted in case it's needed
+        if (IsFollow() && IsFieldFollow())
+        {
+            SwTextFrame *pMaster = FindMaster();
+            assert(pMaster);
+            if (!pMaster->HasPara())
+            {
+                pMaster->GetFormatted();
+            }
+            if (!pMaster->HasPara())
+            {   // master could be locked because it's being formatted upstack
+                SAL_WARN("sw", "SwTextFrame::Format: failed to format master!");
+            }
+            else
+            {
+                SwTextSizeInfo aInf( pMaster );
+                SwTextIter aMasterLine( pMaster, &aInf );
+                aMasterLine.Bottom();
+                SetOfst(aMasterLine.GetEnd());
+            }
+        }
+
         SwTextLineAccess aAccess( this );
         const bool bNew = !aAccess.IsAvailable();
         const bool bSetOfst =