commit 77508eee7687462e991c4fac3ba6ae8ec2650987
author Caolán McNamara <caolanm@redhat.com> Wed Feb 06 12:09:27 2019 +0000
committer Caolán McNamara <caolanm@redhat.com> Wed Feb 06 15:30:35 2019 +0100
tree 975919c79e7286b317fe7ee38b076f7f40eac5bf
parent 98c0b20864af965c3bb99a32f8ea57be7402e534

fix assert seen on opening attachment from tdf#123163

I imagine it should have been seqPos-(idPos+2)

seems to be like this since the initial commit of

commit 091fe76b6329b4bb974987554369cbfadd8f2401
Date:   Tue Jun 30 12:55:18 2015 +0300

    tdf#87348 implement mso-next-textbox vml-style textbox chaining import

Change-Id: Ic2f527ede2102c01c8589d58d8c705d59b0a6ffe
Reviewed-on: https://gerrit.libreoffice.org/67450
Reviewed-by: Justin Luth <justin_luth@sil.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

oox/source/vml/vmlshape.cxx

diff --git a/oox/source/vml/vmlshape.cxx b/oox/source/vml/vmlshape.cxx
index 7118c92b..951c164 100644
--- a/oox/source/vml/vmlshape.cxx
+++ b/oox/source/vml/vmlshape.cxx
@@ -367,7 +367,8 @@ Reference< XShape > ShapeBase::convertAndInsert( const Reference< XShapes >& rxS
                    sal_Int32 seqPos = sLinkChainName.indexOf("_s",idPos);
                    if (idPos < seqPos)
                    {
                        id = sLinkChainName.copy(idPos+2,seqPos-idPos+2).toInt32();
                        auto idPosEnd = idPos+2;
                        id = sLinkChainName.copy(idPosEnd, seqPos - idPosEnd).toInt32();
                        seq = sLinkChainName.copy(seqPos+2).toInt32();
                    }
                }