From: Michael Weghorn <m.weghorn@posteo.de>
Date: Wed, 5 Sep 2018 16:03:06 +0000 (+0200)
Subject: tdf#119685 Fix infinite loop in gtk3_kde5 filepicker
X-Git-Tag: archive/raspbian/1%6.1.1-1+rpi1^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=ee89c07e6e4a3b170208124a6a9c3d672a0b9ece;p=libreoffice.git

tdf#119685 Fix infinite loop in gtk3_kde5 filepicker

Since 'string::find()' returns the position of the given
character in the string and that was passed as the amount of
characters to delete from the string, 'm_responseBuffer'
would always be a string starting with a newline character
afterwards, when this part of the code was reached.

Subsequent calls to 'Gtk3KDE5FilePickerIpc::readResponseLine'
therefore always returned an empty string and left
'm_responseBuffer' unchanged, resulting in the lambda function
inside 'readResponse' in 'gtk3_kde5_filepicker_ipc.hxx' to
loop infinitely.

While at it, make a little more explicit that 'it' is of type
'size_t' here.

Change-Id: I3b1c209f8307ab71465d9538a82616dff8656415
Reviewed-on: https://gerrit.libreoffice.org/60047
Tested-by: Jenkins
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
(cherry picked from commit 1f5698ba8b62e62999b0efb363916a91bdd54c94)
Reviewed-on: https://gerrit.libreoffice.org/60067
Reviewed-by: Katarina Behrens <Katarina.Behrens@cib.de>

Gbp-Pq: Name fix-gtk3_kde5-filepicker-infinite-loop.diff
---

diff --git a/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx b/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx
index 21690c5e74f..8cec9d853fb 100644
--- a/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx
+++ b/vcl/unx/gtk3_kde5/gtk3_kde5_filepicker_ipc.cxx
@@ -222,11 +222,11 @@ std::string Gtk3KDE5FilePickerIpc::readResponseLine()
 {
     if (!m_responseBuffer.empty()) // check whether we have a line in our buffer
     {
-        auto it = m_responseBuffer.find('\n');
+        std::size_t it = m_responseBuffer.find('\n');
         if (it != std::string::npos)
         {
             auto ret = m_responseBuffer.substr(0, it);
-            m_responseBuffer.erase(0, it);
+            m_responseBuffer.erase(0, it + 1);
             return ret;
         }
     }