From 0f23433ae5c0e6d3e56027b883599ed3a2b49086 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Sun, 23 Aug 2020 20:47:00 +0100 Subject: ofz#25169 insertion into set might find a duplicate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit in which case pImpRec is deleted and pImpRecTmp is invalid Change-Id: I2a273a436ebd88cb53e329bbcb4f171dda6ed840 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/101248 Tested-by: Jenkins Reviewed-by: Caolán McNamara --- sw/source/filter/ww8/ww8par.cxx | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'sw') diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index 9e8429a06768..74eb087675c5 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -1079,7 +1079,9 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt, if( pImpRec->nShapeId ) { - auto pImpRecTmp = pImpRec.get(); + auto nShapeId = pImpRec->nShapeId; + auto nShapeOrder = (static_cast(pImpRec->aTextId.nTxBxS) << 16) + + pImpRec->aTextId.nSequence; // Complement Import Record List pImpRec->pObj = pObj; rImportData.insert(std::move(pImpRec)); @@ -1091,9 +1093,9 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt, ( (rObjData.nSpFlags & ShapeFlag::Group) && (rObjData.nCalledByGroup < 2) ) ) - StoreShapeOrder( pImpRecTmp->nShapeId, - ( static_cast(pImpRecTmp->aTextId.nTxBxS) << 16 ) - + pImpRecTmp->aTextId.nSequence, pObj ); + { + StoreShapeOrder(nShapeId, nShapeOrder, pObj); + } } else pImpRec.reset(); -- cgit