diff options
| -rw-r--r-- | sw/qa/extras/uiwriter/data/tdf114536.odt | bin | 0 -> 13623 bytes | |||
| -rw-r--r-- | sw/qa/extras/uiwriter/uiwriter.cxx | 9 | ||||
| -rw-r--r-- | sw/source/core/text/itrform2.cxx | 13 |
3 files changed, 22 insertions, 0 deletions
diff --git a/sw/qa/extras/uiwriter/data/tdf114536.odt b/sw/qa/extras/uiwriter/data/tdf114536.odt Binary files differnew file mode 100644 index 000000000000..4ad9c7f1f494 --- /dev/null +++ b/sw/qa/extras/uiwriter/data/tdf114536.odt diff --git a/sw/qa/extras/uiwriter/uiwriter.cxx b/sw/qa/extras/uiwriter/uiwriter.cxx index 9f4597486f3e..1e8d7431bc52 100644 --- a/sw/qa/extras/uiwriter/uiwriter.cxx +++ b/sw/qa/extras/uiwriter/uiwriter.cxx @@ -296,6 +296,7 @@ public: void testTdf114306(); void testTdf113481(); void testTdf115013(); + void testTdf114536(); CPPUNIT_TEST_SUITE(SwUiWriterTest); CPPUNIT_TEST(testReplaceForward); @@ -471,6 +472,7 @@ public: CPPUNIT_TEST(testTdf114306); CPPUNIT_TEST(testTdf113481); CPPUNIT_TEST(testTdf115013); + CPPUNIT_TEST(testTdf114536); CPPUNIT_TEST_SUITE_END(); private: @@ -5546,6 +5548,13 @@ void SwUiWriterTest::testSectionInTableInTable() createDoc("tdf112109.fodt"); } +void SwUiWriterTest::testTdf114536() +{ + // This crashed in SwTextFormatter::MergeCharacterBorder() due to a + // use after free. + createDoc("tdf114536.odt"); +} + void SwUiWriterTest::testSectionInTableInTable2() { createDoc("split-section-in-nested-table.fodt"); diff --git a/sw/source/core/text/itrform2.cxx b/sw/source/core/text/itrform2.cxx index 2b7d853ee734..c4df1a42e81e 100644 --- a/sw/source/core/text/itrform2.cxx +++ b/sw/source/core/text/itrform2.cxx @@ -268,6 +268,19 @@ SwLinePortion *SwTextFormatter::Underflow( SwTextFormatInfo &rInf ) pPor = m_pCurr; } } + + // Make sure that m_pFirstOfBorderMerge does not point to a portion which + // will be deleted by Truncate() below. + SwLinePortion* pNext = pPor->GetPortion(); + while (pNext) + { + if (pNext == m_pFirstOfBorderMerge) + { + m_pFirstOfBorderMerge = nullptr; + break; + } + pNext = pNext->GetPortion(); + } pPor->Truncate(); SwLinePortion *const pRest( rInf.GetRest() ); if (pRest && pRest->InFieldGrp() && |