From bfd2393ca7247aae1b09e661610a5f750b6e06fa Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 27 Sep 2018 11:56:57 +0100
Subject: ofz#10696 null-deref
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

since...

commit c6b8587eef3ead53418312c43012f4322789a33a
Date:   Wed Sep 19 16:35:10 2018 +0200

    loplugin:useuniqueptr in SvxRTFParser

Change-Id: Id901d5645500fedcb54b11e1b5b27fe81281f5a2
Reviewed-on: https://gerrit.libreoffice.org/61033
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 editeng/source/rtf/svxrtf.cxx | 1 +
 1 file changed, 1 insertion(+)

(limited to 'editeng')

diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index bfd67ed4ced4..1c4f7f246d09 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -680,6 +680,7 @@ void SvxRTFParser::AttrGroupEnd()   // process the current, delete from Stack
     if( !aAttrStack.empty() )
     {
         std::unique_ptr<SvxRTFItemStackType> pOld = std::move(aAttrStack.back());
+        aAttrStack.pop_back();
         SvxRTFItemStackType *pCurrent = aAttrStack.empty() ? nullptr : aAttrStack.back().get();
 
         do {        // middle check loop
-- 
cgit