diff options
author | Michael Stahl <mstahl@redhat.com> | 2016-11-24 14:18:05 +0100 |
---|---|---|
committer | Michael Stahl <mstahl@redhat.com> | 2016-11-25 13:00:49 +0000 |
commit | dbfa3841018672d8af8e9bf1bdb4caf6cdf0ce7d (patch) | |
tree | 32186821ec9fd42d17aa7c748b663ed38c545c7b /COPYING.LGPL | |
parent | 4f8eff151e8ec71eb1a5b6757d9b17d3224d67ca (diff) |
tdf#103788 sw: fix use-after-free in navigator dialog
The problem is that if SwContentTree::HasContentChanged() returns true,
it may have deleted the SwTypeNumber instances that are referenced in
SvTreeListEntry::pUserData, but it has not reset pUserData so those
pointers are now used to acceess deleted objects.
Also it looks like the HasContentChanged() detects additional conditions
that would not cause a modified event from the document but should still
cause a repaint, such as when the user moves the cursor between
headings.
Revert the optimization, it was a stupid idea.
(regression from 329742e6c9da7cd7848d92a6846e3d1249d8d9b4)
Change-Id: Idb5207e896b0638324fc41b7c214536be4ba864b
(cherry picked from commit cbdf4e007650cfda4f7808402e8e24ae66d45792)
Reviewed-on: https://gerrit.libreoffice.org/31194
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'COPYING.LGPL')
0 files changed, 0 insertions, 0 deletions