commit 45510866fedac63014a3120a1130dbea9fd803ee
author Caolán McNamara <caolanm@redhat.com> Wed Feb 06 12:09:27 2019 +0000
committer Michael Stahl <Michael.Stahl@cib.de> Thu Feb 07 10:52:20 2019 +0100
tree 5ed48e1dbba0b1301430c3d0bfa937974cc88139
parent 08aa78cc52ea49fea2454096e97875f1d4b4cecc

fix assert seen on opening attachment from tdf#123163

I imagine it should have been seqPos-(idPos+2)

seems to be like this since the initial commit of

commit 091fe76b6329b4bb974987554369cbfadd8f2401
Date:   Tue Jun 30 12:55:18 2015 +0300

    tdf#87348 implement mso-next-textbox vml-style textbox chaining import

Change-Id: Ic2f527ede2102c01c8589d58d8c705d59b0a6ffe
Reviewed-on: https://gerrit.libreoffice.org/67454
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>

oox/source/vml/vmlshape.cxx

diff --git a/oox/source/vml/vmlshape.cxx b/oox/source/vml/vmlshape.cxx
index 40a547a..0ca3b7e 100644
--- a/oox/source/vml/vmlshape.cxx
+++ b/oox/source/vml/vmlshape.cxx
@@ -358,7 +358,8 @@ Reference< XShape > ShapeBase::convertAndInsert( const Reference< XShapes >& rxS
                    sal_Int32 seqPos = sLinkChainName.indexOf("_s",idPos);
                    if (idPos < seqPos)
                    {
                        id = sLinkChainName.copy(idPos+2,seqPos-idPos+2).toInt32();
                        auto idPosEnd = idPos+2;
                        id = sLinkChainName.copy(idPosEnd, seqPos - idPosEnd).toInt32();
                        seq = sLinkChainName.copy(seqPos+2).toInt32();
                    }
                }