From 4907cf58bae433b833aa7fedc6a8aafd45e75a75 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Sat, 8 Sep 2018 14:45:38 +0100 Subject: ofz#10259 ofz#10263 ofz#10264 ofz#10265 use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I3e845c21f7a4e853ce9548f2992cab324dec05a8 Reviewed-on: https://gerrit.libreoffice.org/60200 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- hwpfilter/source/drawing.h | 5 +++-- hwpfilter/source/hwpread.cxx | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) (limited to 'hwpfilter') diff --git a/hwpfilter/source/drawing.h b/hwpfilter/source/drawing.h index 5c2746da0099..3118ec0c8720 100644 --- a/hwpfilter/source/drawing.h +++ b/hwpfilter/source/drawing.h @@ -85,7 +85,7 @@ HWPDOFuncType HWPDOFuncTbl[] = HWPDOFreeFormFunc, }; -static HMemIODev *hmem = nullptr; +static HIODev *hmem = nullptr; static int count = 0; @@ -631,7 +631,8 @@ static HWPPara *LoadParaList() std::vector< HWPPara* > plist; hwpf->ReadParaList(plist); - hwpf->SetIODevice(std::move(hio)); + std::unique_ptr orighmem = hwpf->SetIODevice(std::move(hio)); + hmem = orighmem.release(); return plist.size()? plist.front() : nullptr; } diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx index 1ed8001513af..9d44a00bc87b 100644 --- a/hwpfilter/source/hwpread.cxx +++ b/hwpfilter/source/hwpread.cxx @@ -460,7 +460,7 @@ bool Picture::Read(HWPFile & hwpf) if (pictype == PICTYPE_DRAW) { - HMemIODev* pOldMem = hmem; + HIODev* pOldMem = hmem; HMemIODev* pNewMem = new HMemIODev(reinterpret_cast(follow.data()), follow_block_size); hmem = pNewMem; LoadDrawingObjectBlock(this); -- cgit