summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2018-01-02 16:09:56 +0000
committerCaolán McNamara <caolanm@redhat.com>2018-01-03 14:31:34 +0100
commitdfc72242e5bf67bdd5127bf38ed2ad5b3e49cea3 (patch)
tree3a64250b88c4f5c5411258307fb3718319569a34
parent5b7ec49f453c3732e2482b26bce4243eb1a10f40 (diff)
ofz#4872 Null-dereference READ
we're going to need a bigger boat Change-Id: Ie4ee3ae1ac9f906ca3faec412bbafc0c6a911aaf Reviewed-on: https://gerrit.libreoffice.org/47269 Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com>
-rw-r--r--sw/source/filter/html/htmltab.cxx62
1 files changed, 51 insertions, 11 deletions
diff --git a/sw/source/filter/html/htmltab.cxx b/sw/source/filter/html/htmltab.cxx
index d138e66612db..92ec9aa5c928 100644
--- a/sw/source/filter/html/htmltab.cxx
+++ b/sw/source/filter/html/htmltab.cxx
@@ -4981,6 +4981,48 @@ HTMLTableOptions::HTMLTableOptions( const HTMLOptions& rOptions,
}
}
+namespace
+{
+ class FrameDeleteWatch : public SwClient
+ {
+ SwFrameFormat* m_pObjectFormat;
+ bool m_bDeleted;
+ public:
+ FrameDeleteWatch(SwFrameFormat* pObjectFormat)
+ : m_pObjectFormat(pObjectFormat)
+ , m_bDeleted(false)
+ {
+ if (m_pObjectFormat)
+ m_pObjectFormat->Add(this);
+
+ }
+
+ virtual void SwClientNotify(const SwModify& rModify, const SfxHint& rHint) override
+ {
+ SwClient::SwClientNotify(rModify, rHint);
+ if (auto pDrawFrameFormatHint = dynamic_cast<const sw::DrawFrameFormatHint*>(&rHint))
+ {
+ if (pDrawFrameFormatHint->m_eId == sw::DrawFrameFormatHintId::DYING)
+ {
+ m_pObjectFormat->Remove(this);
+ m_bDeleted = true;
+ }
+ }
+ }
+
+ bool WasDeleted() const
+ {
+ return m_bDeleted;
+ }
+
+ virtual ~FrameDeleteWatch() override
+ {
+ if (!m_bDeleted && m_pObjectFormat)
+ m_pObjectFormat->Remove(this);
+ }
+ };
+}
+
std::shared_ptr<HTMLTable> SwHTMLParser::BuildTable(SvxAdjust eParentAdjust,
bool bIsParentHead,
bool bHasParentSection,
@@ -5250,20 +5292,18 @@ std::shared_ptr<HTMLTable> SwHTMLParser::BuildTable(SvxAdjust eParentAdjust,
//if section to be deleted contains a pending m_pMarquee, it will be deleted
//so clear m_pMarquee pointer if that's the case
SwFrameFormat* pObjectFormat = m_pMarquee ? ::FindFrameFormat(m_pMarquee) : nullptr;
- if (pObjectFormat)
- {
- const SwFormatAnchor& rAnch = pObjectFormat->GetAnchor();
- if (const SwPosition* pPos = rAnch.GetContentAnchor())
- {
- SwNodeIndex aMarqueeNodeIndex(pPos->nNode);
- SwNodeIndex aSttIdx(*pSttNd), aEndIdx(*pSttNd->EndOfSectionNode());
- if (aMarqueeNodeIndex >= aSttIdx && aMarqueeNodeIndex <= aEndIdx)
- m_pMarquee = nullptr;
- }
- }
+ FrameDeleteWatch aWatch(pObjectFormat);
m_xDoc->getIDocumentContentOperations().DeleteSection(pSttNd);
xCurTable->SetCaption( nullptr, false );
+
+ if (pObjectFormat)
+ {
+ if (aWatch.WasDeleted())
+ m_pMarquee = nullptr;
+ else
+ pObjectFormat->Remove(&aWatch);
+ }
}
}