diff options
| author | Michael Stahl <Michael.Stahl@cib.de> | 2019-01-30 12:16:30 +0100 |
|---|---|---|
| committer | Thorsten Behrens <Thorsten.Behrens@CIB.de> | 2019-02-01 09:31:16 +0100 |
| commit | ffccaf2110a25f0b05174e6e9728e4e860c6398b (patch) | |
| tree | 6902270481c09d262a7c952c39b664eaf66267bd | |
| parent | d6f96b1a00f85ad5d1eb9baf6e5d2f57d6e93293 (diff) | |
sw: fix use-after-free in SwCursorShell::MoveFieldType()
Change-Id: Ie272373bcef3459b05dc29bf874ecc3fdfa31d4a
Reviewed-on: https://gerrit.libreoffice.org/67151
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
Tested-by: Jenkins
(cherry picked from commit 1ec8caedace2de2b7e6bf91468301548b54a28a8)
Reviewed-on: https://gerrit.libreoffice.org/67173
Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
| -rw-r--r-- | sw/source/core/crsr/crstrvl.cxx | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sw/source/core/crsr/crstrvl.cxx b/sw/source/core/crsr/crstrvl.cxx index cef97092485c..2586ed6483cf 100644 --- a/sw/source/core/crsr/crstrvl.cxx +++ b/sw/source/core/crsr/crstrvl.cxx @@ -737,8 +737,9 @@ bool SwCursorShell::MoveFieldType( if( bDelField ) { - delete static_cast<SwFormatField*>(&pTextField->GetAttr()); + auto const pFormat(static_cast<SwFormatField*>(&pTextField->GetAttr())); delete pTextField; + delete pFormat; } if( it != aSrtLst.end() && isSrch ) // found |