From b931ef8af3a4251bea14bc3a4d61cffb95a7f777 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 26 Oct 2020 20:38:03 +0000
Subject: ofz#26619 detect if SwFrameFormat deleted during import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I5dc778e44dcb670353e83037a5a5d469fa437186
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104853
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 7ae9e8b6ba35dec2c556f6fac4034cd9bb1111a1)
---
 sw/source/filter/html/htmlgrin.cxx |  2 +-
 sw/source/filter/html/swhtml.cxx   | 21 ++++++++++++++++++++-
 sw/source/filter/html/swhtml.hxx   | 11 ++++++++++-
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/sw/source/filter/html/htmlgrin.cxx b/sw/source/filter/html/htmlgrin.cxx
index 488edb6dce06..a390ffc0368e 100644
--- a/sw/source/filter/html/htmlgrin.cxx
+++ b/sw/source/filter/html/htmlgrin.cxx
@@ -284,7 +284,7 @@ void SwHTMLParser::RegisterFlyFrame( SwFrameFormat *pFlyFormat )
         (RndStdIds::FLY_AT_PARA == pFlyFormat->GetAnchor().GetAnchorId()) &&
         css::text::WrapTextMode_THROUGH == pFlyFormat->GetSurround().GetSurround() )
     {
-        m_aMoveFlyFrames.push_back( pFlyFormat );
+        m_aMoveFlyFrames.emplace_back(std::make_unique<SwHTMLFrameFormatListener>(pFlyFormat));
         m_aMoveFlyCnts.push_back( m_pPam->GetPoint()->nContent.GetIndex() );
     }
 }
diff --git a/sw/source/filter/html/swhtml.cxx b/sw/source/filter/html/swhtml.cxx
index aaa6c2e7dd35..3f72a8a044e3 100644
--- a/sw/source/filter/html/swhtml.cxx
+++ b/sw/source/filter/html/swhtml.cxx
@@ -2679,6 +2679,18 @@ SwViewShell *SwHTMLParser::CheckActionViewShell()
     return m_pActionViewShell;
 }
 
+SwHTMLFrameFormatListener::SwHTMLFrameFormatListener(SwFrameFormat* pFrameFormat)
+    : m_pFrameFormat(pFrameFormat)
+{
+    StartListening(m_pFrameFormat->GetNotifier());
+}
+
+void SwHTMLFrameFormatListener::Notify(const SfxHint& rHint)
+{
+    if (rHint.GetId() == SfxHintId::Dying)
+        m_pFrameFormat = nullptr;
+}
+
 void SwHTMLParser::SetAttr_( bool bChkEnd, bool bBeforeTable,
                              std::deque<std::unique_ptr<HTMLAttr>> *pPostIts )
 {
@@ -2938,7 +2950,14 @@ void SwHTMLParser::SetAttr_( bool bChkEnd, bool bBeforeTable,
 
     for( auto n = m_aMoveFlyFrames.size(); n; )
     {
-        SwFrameFormat *pFrameFormat = m_aMoveFlyFrames[ --n ];
+        SwFrameFormat *pFrameFormat = m_aMoveFlyFrames[--n]->GetFrameFormat();
+        if (!pFrameFormat)
+        {
+            SAL_WARN("sw.html", "SwFrameFormat deleted during import");
+            m_aMoveFlyFrames.erase( m_aMoveFlyFrames.begin() + n );
+            m_aMoveFlyCnts.erase( m_aMoveFlyCnts.begin() + n );
+            continue;
+        }
 
         const SwFormatAnchor& rAnchor = pFrameFormat->GetAnchor();
         OSL_ENSURE( RndStdIds::FLY_AT_PARA == rAnchor.GetAnchorId(),
diff --git a/sw/source/filter/html/swhtml.hxx b/sw/source/filter/html/swhtml.hxx
index 58eaaaab715e..b3dc2b12ee5c 100644
--- a/sw/source/filter/html/swhtml.hxx
+++ b/sw/source/filter/html/swhtml.hxx
@@ -325,6 +325,15 @@ namespace o3tl
     template<> struct typed_flags<HtmlFrameFormatFlags> : is_typed_flags<HtmlFrameFormatFlags, 0x0f> {};
 }
 
+class SwHTMLFrameFormatListener : public SvtListener
+{
+    SwFrameFormat* m_pFrameFormat;
+public:
+    SwHTMLFrameFormatListener(SwFrameFormat* pFrameFormat);
+    SwFrameFormat* GetFrameFormat() { return m_pFrameFormat; }
+    virtual void Notify(const SfxHint&) override;
+};
+
 class SwHTMLParser : public SfxHTMLParser, public SvtListener
 {
     friend class SectionSaveStruct;
@@ -360,7 +369,7 @@ class SwHTMLParser : public SfxHTMLParser, public SvtListener
     HTMLAttrs      m_aParaAttrs; // temporary paragraph attributes
     std::shared_ptr<HTMLAttrTable>  m_xAttrTab;   // "open" attributes
     HTMLAttrContexts m_aContexts;// the current context of attribute/token
-    std::vector<SwFrameFormat *> m_aMoveFlyFrames;// Fly-Frames, the anchor is moved
+    std::vector<std::unique_ptr<SwHTMLFrameFormatListener>> m_aMoveFlyFrames;// Fly-Frames, the anchor is moved
     std::deque<sal_Int32> m_aMoveFlyCnts;// and the Content-Positions
     //stray SwTableBoxes which need to be deleted to avoid leaking, but hold
     //onto them until parsing is done
-- 
cgit