commit 4d1b6057627c1fbee8cceefe77f9fb1c0af836d5
author Caolán McNamara <caolanm@redhat.com> Sat Aug 22 10:31:35 2015 +0100
committer David Tardon <dtardon@redhat.com> Sun Aug 23 17:10:48 2015 +0000
tree b4b727dde1b98e8a8459c7e6054e006c67084dac
parent a198e618f6e7a94536c259247151150a6e3ea361

check that src index is in doc range

Change-Id: Ic81e7a14701ff30aa46a9293dd6db351bd350ba5
(cherry picked from commit 3230c8cf1cf2dc486f038d369e7f4f44ffd6b0a7)

check that dest index is in doc range

Change-Id: I3006cf03cf97399a6c418162178acdb1d41c3b23
(cherry picked from commit cd6c9aef7468120dd5ea5c747f35c98baf214613)
Reviewed-on: https://gerrit.libreoffice.org/17925
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>

sw/qa/core/data/ww6/pass/crash-6.doc

diff --git a/sw/qa/core/data/ww6/pass/crash-6.doc b/sw/qa/core/data/ww6/pass/crash-6.doc
new file mode 100644
index 0000000..08c8791
--- /dev/null
+++ b/sw/qa/core/data/ww6/pass/crash-6.doc
Binary files differ

sw/source/filter/basflt/fltshell.cxx

diff --git a/sw/source/filter/basflt/fltshell.cxx b/sw/source/filter/basflt/fltshell.cxx
index be5d9eb..2427161 100644
--- a/sw/source/filter/basflt/fltshell.cxx
+++ b/sw/source/filter/basflt/fltshell.cxx
@@ -120,8 +120,11 @@ bool SwFltStackEntry::MakeRegion(SwDoc* pDoc, SwPaM& rRegion, bool bCheck,

    // The only position of 0x0D will not be able to make region in the old logic
    // because it is beyond the length of para...need special consideration here.
    SwContentNode *const pContentNode(
        SwNodeIndex(rMkPos.m_nNode, +1).GetNode().GetContentNode());
    sal_uLong nMk = rMkPos.m_nNode.GetIndex() + 1;
    const SwNodes& rMkNodes = rMkPos.m_nNode.GetNodes();
    if (nMk >= rMkNodes.Count())
        return false;
    SwContentNode *const pContentNode(rMkNodes[nMk]->GetContentNode());
    if (rMkPos == rPtPos &&
        ((0 != rPtPos.m_nContent) || (pContentNode && (0 != pContentNode->Len())))
        && ( RES_TXTATR_FIELD != nWhich
@@ -138,7 +141,11 @@ bool SwFltStackEntry::MakeRegion(SwDoc* pDoc, SwPaM& rRegion, bool bCheck,
    rRegion.SetMark();
    if (rMkPos.m_nNode != rPtPos.m_nNode)
    {
        rRegion.GetPoint()->nNode = rPtPos.m_nNode.GetIndex() + 1;
        sal_uLong n = rPtPos.m_nNode.GetIndex() + 1;
        SwNodes& rNodes = rRegion.GetPoint()->nNode.GetNodes();
        if (n >= rNodes.Count())
            return false;
        rRegion.GetPoint()->nNode = n;
        pCNd = GetContentNode(pDoc, rRegion.GetPoint()->nNode, false);
    }
    rRegion.GetPoint()->nContent.Assign(pCNd, rPtPos.m_nContent);