ReadShortRes() actually reads a wannabe unsigned here

Insert Hyperlink dialog crashed, for example.
Plus some more sanity checks to guard against negative listbox positions
passed.

Change-Id: I6458df6aab3abebfaf64d767013b57db76872eec

2 files changed, 13 insertions, 9 deletions

diff --git a/vcl/source/control/ilstbox.cxx b/vcl/source/control/ilstbox.cxx
index d57c54f0d2f3..4c0ba9dc4642 100644
--- a/vcl/source/control/ilstbox.cxx
+++ b/vcl/source/control/ilstbox.cxx
@@ -326,12 +326,14 @@ long ImplEntryList::GetAddedHeight( sal_Int32 i_nEndIndex, sal_Int32 i_nBeginInd
     sal_Int32 nStart = i_nEndIndex > i_nBeginIndex ? i_nBeginIndex : i_nEndIndex;
     sal_Int32 nStop  = i_nEndIndex > i_nBeginIndex ? i_nEndIndex : i_nBeginIndex;
     sal_Int32 nEntryCount = GetEntryCount();
-    if( nStop != LISTBOX_ENTRY_NOTFOUND && nEntryCount != 0 )
+    if( 0 <= nStop && nStop != LISTBOX_ENTRY_NOTFOUND && nEntryCount != 0 )
     {
         // sanity check
         if( nStop > nEntryCount-1 )
             nStop = nEntryCount-1;
-        if( nStart > nEntryCount-1 )
+        if (nStart < 0)
+            nStart = 0;
+        else if( nStart > nEntryCount-1 )
             nStart = nEntryCount-1;
 
         sal_Int32 nIndex = nStart;
@@ -1735,7 +1737,7 @@ void ImplListBoxWindow::ImplPaint( sal_Int32 nPos, bool bErase, bool bLayout )
         aRect.Left() -= mnLeft;
         if ( nPos < GetEntryList()->GetMRUCount() )
             nPos = GetEntryList()->FindEntry( GetEntryList()->GetEntryText( nPos ) );
-        nPos = sal::static_int_cast<sal_Int32>(nPos - GetEntryList()->GetMRUCount());
+        nPos = nPos - GetEntryList()->GetMRUCount();
         sal_Int32 nCurr = mnCurrentPos;
         if ( mnCurrentPos < GetEntryList()->GetMRUCount() )
             nCurr = GetEntryList()->FindEntry( GetEntryList()->GetEntryText( nCurr ) );
diff --git a/vcl/source/control/lstbox.cxx b/vcl/source/control/lstbox.cxx
index 7c802d94ca2f..bf6c15b5c243 100644
--- a/vcl/source/control/lstbox.cxx
+++ b/vcl/source/control/lstbox.cxx
@@ -195,8 +195,10 @@ void ListBox::ImplLoadRes( const ResId& rResId )
 {
     Control::ImplLoadRes( rResId );
 
-    sal_Int32 nSelPos = ReadShortRes();
-    sal_Int32 nNumber = sal::static_int_cast<sal_Int32>(ReadLongRes());
+    // The resource short is actually to be treated as unsigned short.
+    sal_uInt16 nResPos = static_cast<sal_uInt16>(ReadShortRes());
+    sal_Int32 nSelPos = (nResPos == SAL_MAX_UINT16) ? LISTBOX_ENTRY_NOTFOUND : nResPos;
+    sal_Int32 nNumber = ReadLongRes();
 
     for( sal_Int32 i = 0; i < nNumber; i++ )
     {
@@ -1044,7 +1046,7 @@ sal_Int32 ListBox::GetEntryPos( const OUString& rStr ) const
 {
     sal_Int32 nPos = mpImplLB->GetEntryList()->FindEntry( rStr );
     if ( nPos != LISTBOX_ENTRY_NOTFOUND )
-        nPos = sal::static_int_cast<sal_Int32>(nPos - mpImplLB->GetEntryList()->GetMRUCount());
+        nPos = nPos - mpImplLB->GetEntryList()->GetMRUCount();
     return nPos;
 }
 
@@ -1052,7 +1054,7 @@ sal_Int32 ListBox::GetEntryPos( const void* pData ) const
 {
     sal_Int32 nPos = mpImplLB->GetEntryList()->FindEntry( pData );
     if ( nPos != LISTBOX_ENTRY_NOTFOUND )
-        nPos = sal::static_int_cast<sal_Int32>(nPos - mpImplLB->GetEntryList()->GetMRUCount());
+        nPos = nPos - mpImplLB->GetEntryList()->GetMRUCount();
     return nPos;
 }
 
@@ -1083,7 +1085,7 @@ sal_Int32 ListBox::GetSelectEntryPos( sal_Int32 nIndex ) const
     {
         if ( nPos < mpImplLB->GetEntryList()->GetMRUCount() )
             nPos = mpImplLB->GetEntryList()->FindEntry( mpImplLB->GetEntryList()->GetEntryText( nPos ) );
-        nPos = sal::static_int_cast<sal_Int32>(nPos - mpImplLB->GetEntryList()->GetMRUCount());
+        nPos = nPos - mpImplLB->GetEntryList()->GetMRUCount();
     }
     return nPos;
 }
@@ -1105,7 +1107,7 @@ void ListBox::SelectEntry( const OUString& rStr, bool bSelect )
 
 void ListBox::SelectEntryPos( sal_Int32 nPos, bool bSelect )
 {
-    if ( nPos < mpImplLB->GetEntryList()->GetEntryCount() )
+    if ( 0 <= nPos && nPos < mpImplLB->GetEntryList()->GetEntryCount() )
     {
         sal_Int32 oldSelectCount = GetSelectEntryCount(), newSelectCount = 0, nCurrentPos = mpImplLB->GetCurrentPos();
         mpImplLB->SelectEntry( nPos + mpImplLB->GetEntryList()->GetMRUCount(), bSelect );