1 files changed, 9 insertions, 3 deletions
diff --git a/sc/source/core/data/bcaslot.cxx b/sc/source/core/data/bcaslot.cxx
index 95482b1c624b..540fb577a79b 100644
--- a/sc/source/core/data/bcaslot.cxx
+++ b/sc/source/core/data/bcaslot.cxx
@@ -136,10 +136,16 @@ ScBroadcastAreaSlot::ScBroadcastAreaSlot( ScDocument* pDocument,
 ScBroadcastAreaSlot::~ScBroadcastAreaSlot()
 {
     for ( ScBroadcastAreas::iterator aIter( aBroadcastAreaTbl.begin());
-            aIter != aBroadcastAreaTbl.end(); ++aIter)
+            aIter != aBroadcastAreaTbl.end(); /* none */)
     {
-        if (!(*aIter)->DecRef())
-            delete *aIter;
+        // Prevent hash from accessing dangling pointer in case area is
+        // deleted.
+        ScBroadcastArea* pArea = *aIter;
+        // Erase all so no hash will be accessed upon destruction of the
+        // hash_set.
+        aBroadcastAreaTbl.erase( aIter++);
+        if (!pArea->DecRef())
+            delete pArea;
     }
 }