From eca5c1a294ac4a8ba28d5b1df47799c462393e0f Mon Sep 17 00:00:00 2001 From: Miklos Vajna Date: Wed, 24 May 2023 15:40:35 +0200 Subject: sw: fix wrong downcast in UndoManager::IsViewUndoActionIndependent() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In case a user types in one view, an other user types in an other view, finally the first user deletes, then getting the undo state resulted in a memory corruption. This went wrong in commit 2875c65946e59f5dd7968155463bf00bd71d440b (sw, out of order undo: allow a subset of a non-empty redo list, 2021-11-11), the intention was to check if we have a redo item and it has the expected type, but we checked the type of an earlier undo action that belongs to the view. Fix the problem by checking the type of the correct undo action, this was probably a copy&paste error of mine. Resolves . (cherry picked from commit f0a9d4d4eea6562e98fd92a2797d16504e1d4db5) Change-Id: I6cb2a081067695a045d86b4ef427cc5a76c0f9c4 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/152272 Tested-by: Caolán McNamara Reviewed-by: Caolán McNamara --- sw/source/core/undo/docundo.cxx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sw/source/core/undo/docundo.cxx b/sw/source/core/undo/docundo.cxx index 3370e7298ed1..12598e094eb6 100644 --- a/sw/source/core/undo/docundo.cxx +++ b/sw/source/core/undo/docundo.cxx @@ -414,7 +414,7 @@ bool UndoManager::IsViewUndoActionIndependent(const SwView* pView, sal_uInt16& r for (size_t i = 0; i < GetRedoActionCount(); ++i) { auto pRedoAction = dynamic_cast(GetRedoAction(i)); - if (!pRedoAction || pViewSwAction->GetId() != SwUndoId::TYPING) + if (!pRedoAction || pRedoAction->GetId() != SwUndoId::TYPING) { return false; } -- cgit v1.2.3