diff options
| author | Miklos Vajna <vmiklos@collabora.com> | 2019-11-07 18:13:01 +0100 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2019-11-07 19:11:54 +0100 |
| commit | 0c49f0f8a16cf3eeb887b6c68213d00bbd56a3eb (patch) | |
| tree | 86426c67aef3b7e0e882056ddc09d2142df7876b /sw | |
| parent | c4ee738407d16effdd04ed9c8f908aa736e3b9a2 (diff) | |
Related: tdf#128603 sw textbox: fix use-after-free
lcl_RestoreAnchor() needs to decide if if wants to not copy the old
anchor (and keep reading it via a reference) or it wants to update the
item set, it can't do both at the same time. The reason for this is that
the item set update works by deleting the old pool item and allocating a
new one, it doesn't work by updating the old pool item.
I believe this was always broken, but now sanitizers found the issue
since the cppunit test for the above bug was added recently.
Change-Id: Ic08d60eb522a62d78cb2b0ea6a4cda328f8fb80b
Reviewed-on: https://gerrit.libreoffice.org/82245
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/core/undo/undraw.cxx | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sw/source/core/undo/undraw.cxx b/sw/source/core/undo/undraw.cxx index e5a7b6974541..b86890723a31 100644 --- a/sw/source/core/undo/undraw.cxx +++ b/sw/source/core/undo/undraw.cxx @@ -164,9 +164,10 @@ static void lcl_RestoreAnchor( SwFrameFormat* pFormat, sal_uLong nNodePos ) aPos.nContent.Assign( aIdx.GetNode().GetContentNode(), nContentPos ); } aTmp.SetAnchor( &aPos ); + RndStdIds nAnchorId = rAnchor.GetAnchorId(); pFormat->SetFormatAttr( aTmp ); - if (RndStdIds::FLY_AS_CHAR == rAnchor.GetAnchorId()) + if (RndStdIds::FLY_AS_CHAR == nAnchorId) { SwTextNode *pTextNd = aIdx.GetNode().GetTextNode(); OSL_ENSURE( pTextNd, "no Text Node" ); |