summaryrefslogtreecommitdiff
path: root/embedserv
diff options
context:
space:
mode:
authorMichael Stahl <mstahl@redhat.com>2016-11-24 14:18:05 +0100
committerMichael Stahl <mstahl@redhat.com>2016-11-24 22:56:32 +0100
commitcbdf4e007650cfda4f7808402e8e24ae66d45792 (patch)
treef5c202c4afe8b8eab491f3e1b65b46ea97eeb353 /embedserv
parentc2c4c6ee16120108590dc64f295ab54e34a05ac0 (diff)
tdf#103788 sw: fix use-after-free in navigator dialog
The problem is that if SwContentTree::HasContentChanged() returns true, it may have deleted the SwTypeNumber instances that are referenced in SvTreeListEntry::pUserData, but it has not reset pUserData so those pointers are now used to acceess deleted objects. Also it looks like the HasContentChanged() detects additional conditions that would not cause a modified event from the document but should still cause a repaint, such as when the user moves the cursor between headings. Revert the optimization, it was a stupid idea. (regression from 329742e6c9da7cd7848d92a6846e3d1249d8d9b4) Change-Id: Idb5207e896b0638324fc41b7c214536be4ba864b
Diffstat (limited to 'embedserv')
0 files changed, 0 insertions, 0 deletions