From b24a15a0aaea310806259eaa20a7d509ce30e5c8 Mon Sep 17 00:00:00 2001 From: Michael Stahl Date: Thu, 2 Apr 2015 23:33:41 +0200 Subject: sw: fix crash on SwUndoDelete after select-all with table at start Somehow the Redo leaves the shell cursor at an invalid offset into the paragraph, which then leads to out-of-bounds string access. Noticed that SwUndRng::SetPaM() leaves an invalid nContent.m_nIndex on the start position, due to a surprising omission in SwIndex::ChgValue(). (regression from 555ff26501d1bbd8a7872c20671c6303db1e1701) Change-Id: I6e6ad7f70835d7e9d6da1fb680e2ae15469fad71 --- sw/source/core/bastyp/index.cxx | 1 + sw/source/core/edit/eddel.cxx | 1 + 2 files changed, 2 insertions(+) diff --git a/sw/source/core/bastyp/index.cxx b/sw/source/core/bastyp/index.cxx index d77e23961d6a..dc5041f3c514 100644 --- a/sw/source/core/bastyp/index.cxx +++ b/sw/source/core/bastyp/index.cxx @@ -81,6 +81,7 @@ SwIndex& SwIndex::ChgValue( const SwIndex& rIdx, sal_Int32 nNewValue ) assert(m_pIndexReg == rIdx.m_pIndexReg); if (!m_pIndexReg) { + m_nIndex = 0; return *this; // no IndexReg => no list to sort into; m_nIndex is 0 } SwIndex* pFnd = const_cast(&rIdx); diff --git a/sw/source/core/edit/eddel.cxx b/sw/source/core/edit/eddel.cxx index 313d079856fb..b5f2db961c2e 100644 --- a/sw/source/core/edit/eddel.cxx +++ b/sw/source/core/edit/eddel.cxx @@ -99,6 +99,7 @@ void SwEditShell::DeleteSel( SwPaM& rPam, bool* pUndo ) // Selection starts at the first para of the first cell, but we // want to delete the table node before the first cell as well. pNewPam->Start()->nNode = pNewPam->Start()->nNode.GetNode().FindTableNode()->GetIndex(); + pNewPam->Start()->nContent.Assign(nullptr, 0); pPam = pNewPam.get(); } // delete everything -- cgit