summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2014-06-26 09:50:18 +0100
committerCaolán McNamara <caolanm@redhat.com>2014-06-27 08:56:52 +0100
commite7161741d186e7edfbaaaf405f157e1cdfccdb5c (patch)
tree3125c413bfed84ecd407af3e9260be5c12336d71
parent1249dd9f358681f61c8ec69a90ce61829601fd0b (diff)
clang: Use-after-free
Change-Id: I5dd857dbf39c8cd62df8b8cd0323b873a79976ae (cherry picked from commit 112645f75816c4902ccf8a2a97ef57e8f13429b8)
-rw-r--r--include/sfx2/sfxbasemodel.hxx2
-rw-r--r--sfx2/source/doc/sfxbasemodel.cxx16
2 files changed, 13 insertions, 5 deletions
diff --git a/include/sfx2/sfxbasemodel.hxx b/include/sfx2/sfxbasemodel.hxx
index fd33b2de799b..c5c5a873e3ca 100644
--- a/include/sfx2/sfxbasemodel.hxx
+++ b/include/sfx2/sfxbasemodel.hxx
@@ -879,7 +879,7 @@ private:
SAL_DLLPRIVATE void loadCmisProperties();
- SAL_DLLPRIVATE void handleLoadError( sal_uInt32 nError, SfxMedium* pMedium );
+ SAL_DLLPRIVATE SfxMedium* handleLoadError( sal_uInt32 nError, SfxMedium* pMedium );
// private variables and methods
diff --git a/sfx2/source/doc/sfxbasemodel.cxx b/sfx2/source/doc/sfxbasemodel.cxx
index 40ab2128492f..d307e9dacc5c 100644
--- a/sfx2/source/doc/sfxbasemodel.cxx
+++ b/sfx2/source/doc/sfxbasemodel.cxx
@@ -1790,6 +1790,9 @@ OUString getFilterProvider( SfxMedium& rMedium )
void setUpdatePickList( SfxMedium* pMedium )
{
+ if (!pMedium)
+ return;
+
bool bHidden = false;
SFX_ITEMSET_ARG(pMedium->GetItemSet(), pHidItem, SfxBoolItem, SID_HIDDEN, false);
if (pHidItem)
@@ -1829,7 +1832,7 @@ void SAL_CALL SfxBaseModel::load( const Sequence< beans::PropertyValue >& seqA
if (!m_pData->m_pObjectShell->DoLoadExternal(pMedium))
nError = ERRCODE_IO_GENERAL;
- handleLoadError(nError, pMedium);
+ pMedium = handleLoadError(nError, pMedium);
setUpdatePickList(pMedium);
return;
}
@@ -1917,7 +1920,7 @@ void SAL_CALL SfxBaseModel::load( const Sequence< beans::PropertyValue >& seqA
m_pData->m_pObjectShell->ResetError();
- handleLoadError(nError, pMedium);
+ pMedium = handleLoadError(nError, pMedium);
loadCmisProperties();
setUpdatePickList(pMedium);
@@ -2662,11 +2665,13 @@ void SfxBaseModel::loadCmisProperties( )
}
}
-void SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
+SfxMedium* SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
{
if (!nError)
+ {
// No error condition.
- return;
+ return pMedium;
+ }
bool bSilent = false;
SFX_ITEMSET_ARG( pMedium->GetItemSet(), pSilentItem, SfxBoolItem, SID_SILENT, false);
@@ -2689,6 +2694,7 @@ void SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
// for whatever reason document now has another medium
OSL_FAIL("Document has rejected the medium?!");
delete pMedium;
+ pMedium = NULL;
}
if ( !bWarning ) // #i30711# don't abort loading if it's only a warning
@@ -2698,6 +2704,8 @@ void SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
"SfxBaseModel::handleLoadError: 0x" + OUString::number(nError, 16),
Reference< XInterface >(), nError);
}
+
+ return pMedium;
}