sw/source/uibase/dochdl/swdtflvr.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit f9c3e9bbe780a394e43bf380cdedb6f2c9c8d8ac
Author:     Noel Grandin <[email protected]>
AuthorDate: Thu Jan 27 09:12:29 2022 +0200
Commit:     Noel Grandin <[email protected]>
CommitDate: Thu Jan 27 09:06:14 2022 +0100

    fix ubsan downcast of SfxInt16Item
    
    source seems to be
        commit 0c8b1efbad48fa9697c0b1afbe4753bbbc3c4c5c
        Date:   Fri Oct 25 15:02:26 2019 +0200
        tdf#127759 Writer: add table row/column insert mode
    
    /sw/source/uibase/shells/tabsh.cxx:872:26: runtime error: downcast of
    address 0x60300137c2f0 which does not point to an object of type 'const
    SfxInt16Item'
    0x60300137c2f0: note: object is of type 'SfxUInt16Item'
    83 25 00 34  d0 ad 9b bc d1 2a 00 00  01 00 00 00 1f 50 00 be  03 00 be
    be be be be be  00 00 00 00
                  ^~~~~~~~~~~~~~~~~~~~~~~
                  vptr for 'SfxUInt16Item'
    /sw/source/uibase/shells/tabsh.cxx:872:26
    SfxRequest&) /workdir/SdiTarget/sw/sdi/swslots.hxx:12197:1
    const&, SfxRequest&, bool) /sfx2/source/control/dispatch.cxx:254:9
    const&, SfxRequest&, SfxCallMode)
    /sfx2/source/control/dispatch.cxx:753:9
    
    Change-Id: Ib5ac07778cf80c6826917d33912594e0b9027fbf
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/129021
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <[email protected]>

diff --git a/sw/source/uibase/dochdl/swdtflvr.cxx 
b/sw/source/uibase/dochdl/swdtflvr.cxx
index 65fefd68804b..8d8c5baf5d6a 100644
--- a/sw/source/uibase/dochdl/swdtflvr.cxx
+++ b/sw/source/uibase/dochdl/swdtflvr.cxx
@@ -1610,7 +1610,7 @@ bool SwTransferable::Paste(SwWrtShell& rSh, 
TransferableDataHelper& rData, RndSt
             // add the other new empty rows/columns after the actual table 
row/column
             if ( nSelectedRowsOrCols > 1 )
             {
-                SfxUInt16Item aCountItem( nDispatchSlot, nSelectedRowsOrCols-1 
);
+                SfxInt16Item aCountItem( nDispatchSlot, nSelectedRowsOrCols-1 
);
                 SfxBoolItem aAfter( FN_PARAM_INSERT_AFTER, true );
                 pDispatch->ExecuteList(nDispatchSlot,
                     SfxCallMode::SYNCHRON|SfxCallMode::RECORD,

Reply via email to