tdf#125624: this bugdoc overflows sal_uInt16

Change-Id: I8ecc08d3ef42b9f7cc501017e0e169bde2196317
Reviewed-on: https://gerrit.libreoffice.org/73654
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

sw/source/core/text/atrhndl.hxx

@@ -47,8 +47,8 @@ private:
     private:
         SwTextAttr*  m_pInitialArray[ INITIAL_NUM_ATTR ];
         SwTextAttr** m_pArray;
-        sal_uInt16 m_nCount; // number of elements on stack
-        sal_uInt16 m_nSize;  // number of positions in Array
+        sal_uInt32 m_nCount; // number of elements on stack
+        sal_uInt32 m_nSize;  // number of positions in Array
 
     public:
         // Ctor, Dtor
@@ -64,7 +64,7 @@ private:
         void Push( const SwTextAttr& rAttr ) { Insert(rAttr, m_nCount); };
         // insert at specified position, take care for not inserting behind
         // the value returned by Count()
-        void Insert( const SwTextAttr& rAttr, const sal_uInt16 nPos );
+        void Insert( const SwTextAttr& rAttr, const sal_uInt32 nPos );
 
         // remove specified attribute
         void Remove( const SwTextAttr& rAttr );
@@ -73,11 +73,11 @@ private:
         const SwTextAttr* Top() const;
 
         // number of elements on stack
-        sal_uInt16 Count() const { return m_nCount; };
+        sal_uInt32 Count() const { return m_nCount; };
 
         // returns position of rAttr on Stack if found, otherwise USHRT_MAX
         // can be used for Remove of an attribute
-        sal_uInt16 Pos( const SwTextAttr& rAttr ) const;
+        sal_uInt32 Pos( const SwTextAttr& rAttr ) const;
     };
 
     SwAttrStack m_aAttrStack[ NUM_ATTRIBUTE_STACKS ]; // stack collection

sw/source/core/text/atrstck.cxx

@@ -270,7 +270,7 @@ inline SwAttrHandler::SwAttrStack::SwAttrStack()
     m_pArray = m_pInitialArray;
 }
 
-void SwAttrHandler::SwAttrStack::Insert( const SwTextAttr& rAttr, const sal_uInt16 nPos )
+void SwAttrHandler::SwAttrStack::Insert( const SwTextAttr& rAttr, const sal_uInt32 nPos )
 {
     // do we still have enough space?
     if (m_nCount >= m_nSize)
@@ -311,7 +311,7 @@ void SwAttrHandler::SwAttrStack::Insert( const SwTextAttr& rAttr, const sal_uInt
 
 void SwAttrHandler::SwAttrStack::Remove( const SwTextAttr& rAttr )
 {
-    sal_uInt16 nPos = Pos( rAttr );
+    sal_uInt32 nPos = Pos( rAttr );
     if (nPos < m_nCount)
     {
         memmove( m_pArray + nPos, m_pArray + nPos + 1,
@@ -326,20 +326,20 @@ const SwTextAttr* SwAttrHandler::SwAttrStack::Top() const
     return m_nCount ? m_pArray[ m_nCount - 1 ] : nullptr;
 }
 
-sal_uInt16 SwAttrHandler::SwAttrStack::Pos( const SwTextAttr& rAttr ) const
+sal_uInt32 SwAttrHandler::SwAttrStack::Pos( const SwTextAttr& rAttr ) const
 {
     if ( ! m_nCount )
         // empty stack
-        return USHRT_MAX;
+        return std::numeric_limits<sal_uInt32>::max();
 
-    for (sal_uInt16 nIdx = m_nCount; nIdx > 0;)
+    for (sal_uInt32 nIdx = m_nCount; nIdx > 0;)
     {
         if (&rAttr == m_pArray[ --nIdx ])
             return nIdx;
     }
 
     // element not found
-    return USHRT_MAX;
+    return std::numeric_limits<sal_uInt32>::max();
 }
 
 SwAttrHandler::SwAttrHandler()
@@ -487,7 +487,7 @@ bool SwAttrHandler::Push( const SwTextAttr& rAttr, const SfxPoolItem& rItem )
         return true;
     }
 
-    const sal_uInt16 nPos = m_aAttrStack[ nStack ].Count();
+    const sal_uInt32 nPos = m_aAttrStack[ nStack ].Count();
     OSL_ENSURE( nPos, "empty stack?" );
     m_aAttrStack[ nStack ].Insert( rAttr, nPos - 1 );
     return false;