don't create uno::Sequence with new, fdo#46825

The uno::Sequence copy c'tor creates a flat copy and increments the ref
count. So if you use new and later delete together with the copy
constructor you get a double delete.

Signed-off-by: Kohei Yoshida <kohei.yoshida@suse.com>

2 files changed, 9 insertions, 13 deletions

diff --git a/xmloff/source/chart/SchXMLTableContext.cxx b/xmloff/source/chart/SchXMLTableContext.cxx
index 55c03682cc90..f1f8af918f06 100644
--- a/xmloff/source/chart/SchXMLTableContext.cxx
+++ b/xmloff/source/chart/SchXMLTableContext.cxx
@@ -730,9 +730,9 @@ SvXMLImportContext* SchXMLTableCellContext::CreateChildContext(
     if( nPrefix == XML_NAMESPACE_TEXT && IsXMLToken( rLocalName, XML_LIST ) && mbReadText )
     {
         SchXMLCell& rCell = mrTable.aData[ mrTable.nRowIndex ][ mrTable.nColumnIndex ];
-        rCell.pComplexString = new Sequence< OUString >();
+        rCell.aComplexString = Sequence< OUString >();
         rCell.eType = SCH_CELL_TYPE_COMPLEX_STRING;
-        pContext = new SchXMLTextListContext( GetImport(), rLocalName, *rCell.pComplexString );
+        pContext = new SchXMLTextListContext( GetImport(), rLocalName, rCell.aComplexString );
         mbReadText = sal_False;//don't apply text from <text:p>
     }
     // <text:p> element - read text (and range from text:id old version)
@@ -772,12 +772,12 @@ void lcl_ApplyCellToComplexLabel( const SchXMLCell& rCell, Sequence< uno::Any >&
         rComplexLabel.realloc(1);
         rComplexLabel[0] = uno::makeAny( rCell.aString );
     }
-    else if( rCell.pComplexString && rCell.eType == SCH_CELL_TYPE_COMPLEX_STRING )
+    else if( rCell.aComplexString.getLength() && rCell.eType == SCH_CELL_TYPE_COMPLEX_STRING )
     {
-        sal_Int32 nCount = rCell.pComplexString->getLength();
+        sal_Int32 nCount = rCell.aComplexString.getLength();
         rComplexLabel.realloc( nCount );
         for( sal_Int32 nN=0; nN<nCount; nN++)
-            rComplexLabel[nN] = uno::makeAny((*rCell.pComplexString)[nN]);
+            rComplexLabel[nN] = uno::makeAny((rCell.aComplexString)[nN]);
     }
     else if( rCell.eType == SCH_CELL_TYPE_FLOAT )
     {
diff --git a/xmloff/source/chart/transporttypes.hxx b/xmloff/source/chart/transporttypes.hxx
index ffa4111a84df..cb03cbc430ae 100644
--- a/xmloff/source/chart/transporttypes.hxx
+++ b/xmloff/source/chart/transporttypes.hxx
@@ -45,17 +45,17 @@ enum SchXMLCellType
 struct SchXMLCell
 {
     rtl::OUString aString;
-    ::com::sun::star::uno::Sequence< rtl::OUString >* pComplexString;
+    ::com::sun::star::uno::Sequence< rtl::OUString > aComplexString;
     double fValue;
     SchXMLCellType eType;
     rtl::OUString aRangeId;
 
-    SchXMLCell() : pComplexString(0), fValue( 0.0 ), eType( SCH_CELL_TYPE_UNKNOWN )
+    SchXMLCell() : aComplexString(), fValue( 0.0 ), eType( SCH_CELL_TYPE_UNKNOWN )
     {}
 
     SchXMLCell( const SchXMLCell& rOther )
         : aString( rOther.aString )
-        , pComplexString( rOther.pComplexString ? new ::com::sun::star::uno::Sequence< rtl::OUString >( *rOther.pComplexString ) : 0 )
+        , aComplexString( rOther.aComplexString )
         , fValue( rOther.fValue )
         , eType( rOther.eType )
         , aRangeId( rOther.aRangeId )
@@ -63,11 +63,7 @@ struct SchXMLCell
 
     ~SchXMLCell()
     {
-        if(pComplexString)
-        {
-            delete pComplexString;
-            pComplexString=0;
-        }
+
     }
 };