abi#7407 RTF export: fix crash on table-in-textframe anchored inside a table

Change-Id: Ia6df265a7f121930b3d9e676e3f76dbbbd4cef4d

2 files changed, 14 insertions, 0 deletions

diff --git a/sw/qa/core/exportdata/rtf/pass/abi7407.odt b/sw/qa/core/exportdata/rtf/pass/abi7407.odt
new file mode 100644
index 000000000000..70bf677560c9
--- /dev/null
+++ b/sw/qa/core/exportdata/rtf/pass/abi7407.odt
diff --git a/sw/source/filter/ww8/rtfattributeoutput.cxx b/sw/source/filter/ww8/rtfattributeoutput.cxx
index beeb4db626b0..6de5e07da49f 100644
--- a/sw/source/filter/ww8/rtfattributeoutput.cxx
+++ b/sw/source/filter/ww8/rtfattributeoutput.cxx
@@ -1617,6 +1617,14 @@ void RtfAttributeOutput::OutputFlyFrame_Impl( const sw::Frame& rFrame, const Poi
             m_rExport.Strm().WriteCharPtr( "{" OOO_STRING_SVTOOLS_RTF_SHPTXT );
 
             {
+                // Save table state, in case the inner text also contains a table.
+                ww8::WW8TableInfo::Pointer_t pTableInfoOrig = m_rExport.mpTableInfo;
+                m_rExport.mpTableInfo = ww8::WW8TableInfo::Pointer_t(new ww8::WW8TableInfo());
+                SwWriteTable* pTableWrt = m_pTableWrt;
+                m_pTableWrt = 0;
+                sal_uInt32 nTableDepth = m_nTableDepth;
+
+                m_nTableDepth = 0;
                 /*
                  * Save m_aRun as we should not loose the opening brace.
                  * OTOH, just drop the contents of m_aRunText in case something
@@ -1644,6 +1652,12 @@ void RtfAttributeOutput::OutputFlyFrame_Impl( const sw::Frame& rFrame, const Poi
                 m_aRunText.clear();
                 m_bInRun = bInRunOrig;
                 m_bSingleEmptyRun = bSingleEmptyRunOrig;
+
+                // Restore table state.
+                m_rExport.mpTableInfo = pTableInfoOrig;
+                delete m_pTableWrt;
+                m_pTableWrt = pTableWrt;
+                m_nTableDepth = nTableDepth;
             }
 
             m_rExport.mpParentFrame = NULL;