diff options
| author | Michael Stahl <michael.stahl@allotropia.de> | 2024-04-04 19:26:31 +0200 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2024-04-05 10:03:13 +0200 |
| commit | 759d822dac5edc6104ce61b70c578425d9f2470d (patch) | |
| tree | a4820923fff47600cd40adaa76bd646978291c61 /sw/source | |
| parent | 2b55a58a2b6918018eca11f8f8cd0452992f239a (diff) | |
sw: layout: remove superfluous pages again in InternalAction()
The bugdoc has a very large header containing hidden text changes height
when toggling Formatting Marks. When toggling on, it crashes, because
UnHide() iterates the text frames in all headers, but after the first
one empty pages at the end of the document are removed, so UAF.
Remove the pages without content earlier; SwLayAction::InternalAction()
already does it after the "normal" page loop, but the 2nd page loop
following that may also move content off pages, so do it again.
Change-Id: Iaae6a16842b3494f25cba8fc036d15049b71961f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165801
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Diffstat (limited to 'sw/source')
| -rw-r--r-- | sw/source/core/layout/layact.cxx | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sw/source/core/layout/layact.cxx b/sw/source/core/layout/layact.cxx index abbca7d67eab..5add4e40a8a7 100644 --- a/sw/source/core/layout/layact.cxx +++ b/sw/source/core/layout/layact.cxx @@ -809,6 +809,12 @@ void SwLayAction::InternalAction(OutputDevice* pRenderContext) unlockPositionOfObjects( pPg ); pPg = static_cast<SwPageFrame*>(pPg->GetNext()); } + if (m_pRoot->IsSuperfluous()) // could be newly set now! + { + bool bOld = IsAgain(); + m_pRoot->RemoveSuperfluous(); + SetAgain(bOld); + } // reset flag for special interrupt content formatting. mbFormatContentOnInterrupt = false; } |