i118640 force early destruction of last FragmentHandler to not let it use an already destroyed RelationsMap instance

1 files changed, 13 insertions, 0 deletions

diff --git a/oox/source/core/xmlfilterbase.cxx b/oox/source/core/xmlfilterbase.cxx
index 8f7408c11338..6c11667fb84a 100644
--- a/oox/source/core/xmlfilterbase.cxx
+++ b/oox/source/core/xmlfilterbase.cxx
@@ -87,6 +87,7 @@ struct XmlFilterBaseImpl
     TextFieldStack      maTextFieldStack;
 
     explicit            XmlFilterBaseImpl( const Reference< XComponentContext >& rxContext ) throw( RuntimeException );
+    ~XmlFilterBaseImpl();
 };
 
 // ----------------------------------------------------------------------------
@@ -121,6 +122,10 @@ XmlFilterBaseImpl::XmlFilterBaseImpl( const Reference< XComponentContext >& rxCo
     maFastParser.registerNamespace( NMSP_markupCompat );    // i123528
 }
 
+XmlFilterBaseImpl::~XmlFilterBaseImpl()
+{
+}
+
 // ============================================================================
 
 XmlFilterBase::XmlFilterBase( const Reference< XComponentContext >& rxContext ) throw( RuntimeException ) :
@@ -133,6 +138,14 @@ XmlFilterBase::XmlFilterBase( const Reference< XComponentContext >& rxContext )
 
 XmlFilterBase::~XmlFilterBase()
 {
+    // #118640# Reset the DocumentHandler at the FastSaxParser manually; this is
+    // needed since the mechanism is that instances of FragmentHandler execute
+    // their stuff (creating objects, setting attributes, ...) on being destroyed.
+    // They get destroyed by setting a new DocumentHandler. This also happens in
+    // the following implicit destruction chain of ~XmlFilterBaseImpl, but in that
+    // case it's member RelationsMap maRelationsMap will be destroyed, but maybe
+    // still be used by ~FragmentHandler -> crash.
+    mxImpl->maFastParser.setDocumentHandler( 0 );
 }
 
 // ----------------------------------------------------------------------------