diff options
| author | Matthew J. Francis <mjay.francis@gmail.com> | 2014-10-19 16:24:55 +0800 |
|---|---|---|
| committer | Noel Grandin <noelgrandin@gmail.com> | 2014-10-20 18:56:59 +0000 |
| commit | 36b25a83fe0b6b0ae0f179bedfc207375633ed19 (patch) | |
| tree | dca1ac3fe6497f9d9061c9595b04aca579e005f2 | |
| parent | bd4e81bab2726cbab30b58a71c25db9b7d1ddb7e (diff) | |
fdo#85185 Copy OUString argument to avoid a use after free
The original OUString is destroyed along with its containing
object part way through the call to PaletteManager::PopupColorPicker(),
so a copy must be taken
Change-Id: I8417ff23a17003e80a4f65e0cf1ad2a8dda5386c
Reviewed-on: https://gerrit.libreoffice.org/12031
Reviewed-by: Noel Grandin <noelgrandin@gmail.com>
Tested-by: Noel Grandin <noelgrandin@gmail.com>
| -rw-r--r-- | svx/source/tbxctrls/PaletteManager.cxx | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/svx/source/tbxctrls/PaletteManager.cxx b/svx/source/tbxctrls/PaletteManager.cxx index ca4c014c8ef7..c561a5e6fb1b 100644 --- a/svx/source/tbxctrls/PaletteManager.cxx +++ b/svx/source/tbxctrls/PaletteManager.cxx @@ -197,6 +197,8 @@ void PaletteManager::SetBtnUpdater(svx::ToolboxButtonColorUpdater* pBtnUpdater) void PaletteManager::PopupColorPicker(const OUString& aCommand) { + // The calling object goes away during aColorDlg.Execute(), so we must copy this + OUString aCommandCopy = aCommand; SvColorDialog aColorDlg( 0 ); aColorDlg.SetColor ( mLastColor ); aColorDlg.SetMode( svtools::ColorPickerMode_MODIFY ); @@ -206,7 +208,7 @@ void PaletteManager::PopupColorPicker(const OUString& aCommand) mpBtnUpdater->Update( aColorDlg.GetColor() ); mLastColor = aColorDlg.GetColor(); AddRecentColor( mLastColor ); - DispatchColorCommand(aCommand, mLastColor); + DispatchColorCommand(aCommandCopy, mLastColor); } } |