diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-12-10 17:12:08 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-12-10 17:13:55 +0000 |
| commit | 4de09a9efdb62cf90ce18662852e556cf7148e14 (patch) | |
| tree | 63801dae81921cd51c3aafac1a82b32029be6bd6 /sw | |
| parent | a73ece414c6556fc88d1c42b71ce7548ddbf536a (diff) | |
coverity#738980 Use after free
Change-Id: I30657eb609a9d02217238dd37a3f23e05168569c
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/core/layout/ssfrm.cxx | 26 |
1 files changed, 17 insertions, 9 deletions
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx index dbda7c1cfdfb..02f834f4a5d8 100644 --- a/sw/source/core/layout/ssfrm.cxx +++ b/sw/source/core/layout/ssfrm.cxx @@ -457,7 +457,10 @@ void SwLayoutFrm::Destroy() // #i28701# SwAnchoredObject* pAnchoredObj = (*pFrm->GetDrawObjs())[0]; if ( pAnchoredObj->ISA(SwFlyFrm) ) + { delete pAnchoredObj; + assert(!pFrm->GetDrawObjs() || nCnt > pFrm->GetDrawObjs()->size()); + } else { SdrObject* pSdrObj = pAnchoredObj->DrawObj(); @@ -469,11 +472,12 @@ void SwLayoutFrm::Destroy() { pContact->DisconnectObjFromLayout( pSdrObj ); } - } - if ( pFrm->GetDrawObjs() && - nCnt == pFrm->GetDrawObjs()->size() ) - { - pFrm->GetDrawObjs()->Remove( *pAnchoredObj ); + + if ( pFrm->GetDrawObjs() && + nCnt == pFrm->GetDrawObjs()->size() ) + { + pFrm->GetDrawObjs()->Remove( *pAnchoredObj ); + } } } pFrm->Remove(); @@ -488,7 +492,10 @@ void SwLayoutFrm::Destroy() // #i28701# SwAnchoredObject* pAnchoredObj = (*GetDrawObjs())[0]; if ( pAnchoredObj->ISA(SwFlyFrm) ) + { delete pAnchoredObj; + assert(!GetDrawObjs() || nCnt > GetDrawObjs()->size()); + } else { SdrObject* pSdrObj = pAnchoredObj->DrawObj(); @@ -500,10 +507,11 @@ void SwLayoutFrm::Destroy() { pContact->DisconnectObjFromLayout( pSdrObj ); } - } - if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() ) - { - GetDrawObjs()->Remove( *pAnchoredObj ); + + if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() ) + { + GetDrawObjs()->Remove( *pAnchoredObj ); + } } } } |