diff options
| author | Norbert Thiebaud <nthiebaud@gmail.com> | 2013-02-17 11:43:59 -0600 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2013-02-18 15:21:03 +0000 |
| commit | f7ddccdac0cedcc32c093de086df0e61416a635b (patch) | |
| tree | 0209ac51dd6bf6435418ff4e5ae0fcdecc733efe /sw | |
| parent | 51a83689fe2270dd861d0929d71bf73623d379c5 (diff) | |
coverity#984443 Use after free
Change-Id: I3736de989ab9978ba20883ffcad635729048e4f9
Reviewed-on: https://gerrit.libreoffice.org/2198
Tested-by: Caolán McNamara <caolanm@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/core/layout/sectfrm.cxx | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sw/source/core/layout/sectfrm.cxx b/sw/source/core/layout/sectfrm.cxx index 05676fd10211..9722b23c2057 100644 --- a/sw/source/core/layout/sectfrm.cxx +++ b/sw/source/core/layout/sectfrm.cxx @@ -932,6 +932,10 @@ static SwFtnFrm* lcl_FindEndnote( SwSectionFrm* &rpSect, bool &rbEmpty, SwFtnFrm* pRet = (SwFtnFrm*)pFtnCont->Lower(); while( pRet ) // look for endnotes { + /* CollectEndNode can destroy pRet so we need to get the + next early + */ + SwFtnFrm* pRetNext = (SwFtnFrm*)pRet->GetNext(); if( pRet->GetAttr()->GetFtn().IsEndNote() ) { if( pRet->GetMaster() ) @@ -944,7 +948,7 @@ static SwFtnFrm* lcl_FindEndnote( SwSectionFrm* &rpSect, bool &rbEmpty, else return pRet; // Found } - pRet = (SwFtnFrm*)pRet->GetNext(); + pRet = pRetNext; } } pCol = (SwColumnFrm*)pCol->GetNext(); |