From 647ce83f41e7cda6ef8171c575c6c1ec5245b43f Mon Sep 17 00:00:00 2001
From: Michael Stahl <mstahl@redhat.com>
Date: Thu, 2 Apr 2015 23:33:41 +0200
Subject: [PATCH 2/4] sw: fix crash on SwUndoDelete after select-all with table
 at start
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Somehow the Redo leaves the shell cursor at an invalid offset into the
paragraph, which then leads to out-of-bounds string access.

Noticed that SwUndRng::SetPaM() leaves an invalid nContent.m_nIndex on
the start position, due to a surprising omission in SwIndex::ChgValue().

(regression from 555ff26501d1bbd8a7872c20671c6303db1e1701)

Change-Id: I6e6ad7f70835d7e9d6da1fb680e2ae15469fad71
(cherry picked from commit b24a15a0aaea310806259eaa20a7d509ce30e5c8)
Reviewed-on: https://gerrit.libreoffice.org/15128
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit add86b9d5fcf3cb52549e64be148ba9e7bb4005e)
---
 sw/source/core/bastyp/index.cxx | 1 +
 sw/source/core/edit/eddel.cxx   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/sw/source/core/bastyp/index.cxx b/sw/source/core/bastyp/index.cxx
index 81da0bb..88eb691 100644
--- a/sw/source/core/bastyp/index.cxx
+++ b/sw/source/core/bastyp/index.cxx
@@ -80,6 +80,7 @@ SwIndex& SwIndex::ChgValue( const SwIndex& rIdx, sal_Int32 nNewValue )
     assert(m_pIndexReg == rIdx.m_pIndexReg);
     if (!m_pIndexReg)
     {
+        m_nIndex = 0;
         return *this; // no IndexReg => no list to sort into; m_nIndex is 0
     }
     SwIndex* pFnd = const_cast<SwIndex*>(&rIdx);
diff --git a/sw/source/core/edit/eddel.cxx b/sw/source/core/edit/eddel.cxx
index fad1eaf..9e2c7b2 100644
--- a/sw/source/core/edit/eddel.cxx
+++ b/sw/source/core/edit/eddel.cxx
@@ -98,6 +98,7 @@ void SwEditShell::DeleteSel( SwPaM& rPam, bool* pUndo )
             // Selection starts at the first para of the first cell, but we
             // want to delete the table node before the first cell as well.
             pNewPam->Start()->nNode = pNewPam->Start()->nNode.GetNode().FindTableNode()->GetIndex();
+            pNewPam->Start()->nContent.Assign(nullptr, 0);
             pPam = pNewPam.get();
         }
         // delete everything
-- 
2.1.0