From 2a3d436aa2fa7df3dc027e7c410ea8c34b908deb Mon Sep 17 00:00:00 2001
From: Miklos Vajna <vmiklos@collabora.com>
Date: Thu, 25 Feb 2021 11:04:01 +0100
Subject: sw: fix incorrect loop condition in SwTransferable::isComplex()

We're not consuming hints in that loop, so we want to end when the
iteration ended, not when the list of hints is empty.

Conflicts:
	sw/qa/uibase/dochdl/dochdl.cxx

Change-Id: I2cb735c03c3551f7b0be8b314183780eedff9ecf
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111558
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
---
 sw/qa/uibase/dochdl/dochdl.cxx       | 28 ++++++++++++++++++++++++++++
 sw/source/uibase/dochdl/swdtflvr.cxx |  2 +-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/sw/qa/uibase/dochdl/dochdl.cxx b/sw/qa/uibase/dochdl/dochdl.cxx
index 07e50a78df36..c2825357ba22 100644
--- a/sw/qa/uibase/dochdl/dochdl.cxx
+++ b/sw/qa/uibase/dochdl/dochdl.cxx
@@ -18,6 +18,9 @@
 #include <editeng/outlobj.hxx>
 #include <editeng/editobj.hxx>
 #include <vcl/transfer.hxx>
+#include <editeng/wghtitem.hxx>
+#include <editeng/postitem.hxx>
+#include <editeng/udlnitem.hxx>
 
 #include <IDocumentContentOperations.hxx>
 #include <cmdid.h>
@@ -27,6 +30,7 @@
 #include <IDocumentDrawModelAccess.hxx>
 #include <drawdoc.hxx>
 #include <swdtflvr.hxx>
+#include <view.hxx>
 
 /// Covers sw/source/uibase/dochdl/ fixes.
 class SwUibaseDochdlTest : public SwModelTestBase
@@ -70,6 +74,30 @@ CPPUNIT_TEST_FIXTURE(SwUibaseDochdlTest, testSelectPasteFormat)
     CPPUNIT_ASSERT_EQUAL(SotClipboardFormatId::EMBED_SOURCE, nFormat);
 }
 
+CPPUNIT_TEST_FIXTURE(SwUibaseDochdlTest, testComplexSelection)
+{
+    // Given a document where a text node has hints, but no as-char images.
+    SwDoc* pDoc = createDoc();
+    SwDocShell* pDocShell = pDoc->GetDocShell();
+    SwWrtShell* pWrtShell = pDocShell->GetWrtShell();
+    pWrtShell->Insert2("abc");
+    pWrtShell->Left(CRSR_SKIP_CHARS, /*bSelect=*/false, 1, /*bBasicCall=*/false);
+    pWrtShell->Left(CRSR_SKIP_CHARS, /*bSelect=*/true, 1, /*bBasicCall=*/false);
+    SfxItemSet aSet(pWrtShell->GetView().GetPool(),
+                    svl::Items<RES_CHRATR_BEGIN, RES_CHRATR_END - 1>{});
+    // Bold, italic, underline.
+    aSet.Put(SvxWeightItem(WEIGHT_BOLD, RES_CHRATR_WEIGHT));
+    aSet.Put(SvxPostureItem(ITALIC_NORMAL, RES_CHRATR_POSTURE));
+    aSet.Put(SvxUnderlineItem(LINESTYLE_SINGLE, RES_CHRATR_UNDERLINE));
+    pWrtShell->SetAttrSet(aSet);
+    uno::Reference<datatransfer::XTransferable2> xTransfer = new SwTransferable(*pWrtShell);
+
+    // When checking if the selection is complex, then there should be no crash.
+    // Without the accompanying fix in place, this test would have crashed, because we read past the
+    // end of the hints array.
+    CPPUNIT_ASSERT(!xTransfer->isComplex());
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/uibase/dochdl/swdtflvr.cxx b/sw/source/uibase/dochdl/swdtflvr.cxx
index 187332ba64f3..e58f95a95ccb 100644
--- a/sw/source/uibase/dochdl/swdtflvr.cxx
+++ b/sw/source/uibase/dochdl/swdtflvr.cxx
@@ -449,7 +449,7 @@ sal_Bool SAL_CALL SwTransferable::isComplex()
             {
                 if (pTextNode->HasHints())
                 {
-                    for (size_t nHint = 0; pTextNode->GetSwpHints().Count(); ++nHint)
+                    for (size_t nHint = 0; nHint < pTextNode->GetSwpHints().Count(); ++nHint)
                     {
                         SwTextAttr* pHint = pTextNode->GetSwpHints().Get(nHint);
                         if (pHint->Which() == RES_TXTATR_FLYCNT)
-- 
cgit