tdf#162398: InsertItem_ may modify items

... which would invalidate the iterators of the for loop.

Change-Id: I4962441e75a304a46d6f8ef5bc44fae1f4e03cc7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171642
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

3 files changed, 46 insertions, 2 deletions

diff --git a/sw/qa/extras/odfimport/data/tdf162398.fodt b/sw/qa/extras/odfimport/data/tdf162398.fodt
new file mode 100644
index 000000000000..c4b7a8ca44bb
--- /dev/null
+++ b/sw/qa/extras/odfimport/data/tdf162398.fodt
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" office:version="1.3" office:mimetype="application/vnd.oasis.opendocument.text">
+ <office:font-face-decls>
+  <style:font-face style:name="Liberation Sans" svg:font-family="&apos;Liberation Sans&apos;" style:font-family-generic="swiss" style:font-pitch="variable"/>
+  <style:font-face style:name="Liberation Serif" svg:font-family="&apos;Liberation Serif&apos;" style:font-family-generic="roman" style:font-pitch="variable"/>
+ </office:font-face-decls>
+ <office:automatic-styles>
+  <style:style style:name="T1" style:family="text">
+   <style:text-properties style:font-name="Liberation Sans" fo:font-size="14pt"/>
+  </style:style>
+  <style:style style:name="T2" style:family="text">
+   <style:text-properties style:font-name="Liberation Serif" fo:font-size="13pt"/>
+  </style:style>
+ </office:automatic-styles>
+ <office:body>
+  <office:text>
+   <text:p><text:span text:style-name="T1">Foo </text:span><text:a xlink:type="simple" xlink:href="https://example.org"><text:span text:style-name="T1">bar </text:span><text:span text:style-name="T2">baz</text:span></text:a><text:span text:style-name="T1">.</text:span></text:p>
+  </office:text>
+ </office:body>
+</office:document>
\ No newline at end of file
diff --git a/sw/qa/extras/odfimport/odfimport.cxx b/sw/qa/extras/odfimport/odfimport.cxx
index 19258ebbe37d..900cbe917b2c 100644
--- a/sw/qa/extras/odfimport/odfimport.cxx
+++ b/sw/qa/extras/odfimport/odfimport.cxx
@@ -1627,6 +1627,29 @@ CPPUNIT_TEST_FIXTURE(Test, testTdf161054)
     }
 }
 
+CPPUNIT_TEST_FIXTURE(Test, testTdf162398)
+{
+    createSwDoc("tdf162398.fodt");
+    SwXTextDocument* pTextDoc = dynamic_cast<SwXTextDocument*>(mxComponent.get());
+    CPPUNIT_ASSERT(pTextDoc);
+    SwWrtShell* pWrtShell = pTextDoc->GetDocShell()->GetWrtShell();
+    // Ctrl-A
+    pWrtShell->SelAll(); // Selects the whole document.
+
+    // Ctrl-C
+    rtl::Reference<SwTransferable> xTransferable(new SwTransferable(*pWrtShell));
+    xTransferable->Copy();
+
+    pWrtShell->SttEndDoc(false); // Go to the end of the doc.
+
+    // Ctrl-V
+    TransferableDataHelper aDataHelper(
+        TransferableDataHelper::CreateFromSystemClipboard(&pWrtShell->GetView().GetEditWin()));
+
+    // Pasting as HTML must not crash
+    SwTransferable::PasteFormat(*pWrtShell, aDataHelper, SotClipboardFormatId::HTML);
+}
+
 } // end of anonymous namespace
 CPPUNIT_PLUGIN_IMPLEMENT();
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/filter/html/htmlatr.cxx b/sw/source/filter/html/htmlatr.cxx
index a8b394887d7c..21fbc71a836f 100644
--- a/sw/source/filter/html/htmlatr.cxx
+++ b/sw/source/filter/html/htmlatr.cxx
@@ -1489,8 +1489,8 @@ void HTMLEndPosLst::InsertItem( const SfxPoolItem& rItem, sal_Int32 nStart,
         }
 
         std::sort(items.begin(), items.end(), SortEnds(m_aStartLst));
-
-        for (HTMLStartEndPos* pTest : items)
+        // Iterate over a temporary copy of items, because InsertItem_ may modify the vector
+        for (HTMLStartEndPos* pTest : std::vector(items))
         {
             if( pTest->GetStart() < nStart )
             {