process element in endFastElement(), not in dtor

Otherwise with malformed xml the dtor is called in a place where
the processing of the formula apparently corrupts the internal
representation somehow and it is impossible to write the document
back as docx. As a bonus, all UI elements related to saving get
disabled, so the document then cannot be saved at all. Although
this is only with malformed xml, which hopefully should never
happen, it's still better to avoid this. Moreover it seems to be
the proper way of coding the handlers anyway.

2 files changed, 8 insertions, 3 deletions

diff --git a/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx b/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx
index 31aa02c8a6bb..7ec9feff2822 100644
--- a/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx
+++ b/writerfilter/source/ooxml/OOXMLFastContextHandler.cxx
@@ -2371,10 +2371,11 @@ Token_t OOXMLFastContextHandlerWrapper::getToken() const
 
 OOXMLFastContextHandlerMath::OOXMLFastContextHandlerMath(OOXMLFastContextHandler* pContext)
     : OOXMLFastContextHandlerProperties(pContext)
+    , depthCount( 0 )
 {
 }
 
-OOXMLFastContextHandlerMath::~OOXMLFastContextHandlerMath()
+void OOXMLFastContextHandlerMath::process()
 {
     SvGlobalName name( SO3_SM_CLASSID );
     comphelper::EmbeddedObjectContainer container;
@@ -2398,12 +2399,15 @@ void OOXMLFastContextHandlerMath::lcl_startFastElement(Token_t Element,
     throw (uno::RuntimeException, xml::sax::SAXException)
 {
     buffer.appendOpeningTag( Element, Attribs );
+    ++depthCount;
 }
 
 void OOXMLFastContextHandlerMath::lcl_endFastElement(Token_t Element)
     throw (uno::RuntimeException, xml::sax::SAXException)
 {
     buffer.appendClosingTag( Element );
+    if( --depthCount == 0 )
+        process();
 }
 
 uno::Reference< xml::sax::XFastContextHandler >
diff --git a/writerfilter/source/ooxml/OOXMLFastContextHandler.hxx b/writerfilter/source/ooxml/OOXMLFastContextHandler.hxx
index e06f4b18da0e..0d75b7d328f2 100644
--- a/writerfilter/source/ooxml/OOXMLFastContextHandler.hxx
+++ b/writerfilter/source/ooxml/OOXMLFastContextHandler.hxx
@@ -646,11 +646,11 @@ class OOXMLFastContextHandlerMath: public OOXMLFastContextHandlerProperties
 {
 public:
     explicit OOXMLFastContextHandlerMath(OOXMLFastContextHandler * pContext);
-    virtual ~OOXMLFastContextHandlerMath();
-
     virtual string getType() const { return "Math"; }
 
 protected:
+    virtual void process();
+
     virtual void lcl_startFastElement(Token_t Element, const uno::Reference< xml::sax::XFastAttributeList > & Attribs)
         throw (uno::RuntimeException, xml::sax::SAXException);
 
@@ -664,6 +664,7 @@ protected:
 
 private:
     oox::formulaimport::XmlStreamBuilder buffer;
+    int depthCount;
 };