commit 5a5c54b755f09984ecc38bf1f800d185456128b3
author Caolán McNamara <caolanm@redhat.com> Wed Feb 06 12:09:27 2019 +0000
committer Michael Stahl <Michael.Stahl@cib.de> Thu Feb 07 10:52:23 2019 +0100
tree 6ea24fab17922ed70d589a46f75964eb1db42995
parent f5d0a81fc0eff8535c64488355a1b4412cfdbc66

fix assert seen on opening attachment from tdf#123163

I imagine it should have been seqPos-(idPos+2)

seems to be like this since the initial commit of

commit 091fe76b6329b4bb974987554369cbfadd8f2401
Date:   Tue Jun 30 12:55:18 2015 +0300

    tdf#87348 implement mso-next-textbox vml-style textbox chaining import

Change-Id: Ic2f527ede2102c01c8589d58d8c705d59b0a6ffe
Reviewed-on: https://gerrit.libreoffice.org/67453
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>

oox/source/vml/vmlshape.cxx

diff --git a/oox/source/vml/vmlshape.cxx b/oox/source/vml/vmlshape.cxx
index 4e48d2a..b70edfc 100644
--- a/oox/source/vml/vmlshape.cxx
+++ b/oox/source/vml/vmlshape.cxx
@@ -366,7 +366,8 @@ Reference< XShape > ShapeBase::convertAndInsert( const Reference< XShapes >& rxS
                    sal_Int32 seqPos = sLinkChainName.indexOf("_s",idPos);
                    if (idPos < seqPos)
                    {
                        id = sLinkChainName.copy(idPos+2,seqPos-idPos+2).toInt32();
                        auto idPosEnd = idPos+2;
                        id = sLinkChainName.copy(idPosEnd, seqPos - idPosEnd).toInt32();
                        seq = sLinkChainName.copy(seqPos+2).toInt32();
                    }
                }