diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2019-10-28 19:50:10 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2019-10-29 09:17:37 +0100 |
| commit | 80cbd1ceedc1a50a70f3eef61ce38e13f7556422 (patch) | |
| tree | 2093c8a53288be6f9525388d4d653fa7209be831 /hwpfilter | |
| parent | 5d07d19d0d2f036c5aa72fd933f2fe94295cc2df (diff) | |
cid#1448471 Wrapper object use after free
Change-Id: I4a6f31491f857280623302569afa982b37c16e89
Reviewed-on: https://gerrit.libreoffice.org/81629
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'hwpfilter')
| -rw-r--r-- | hwpfilter/source/hwpread.cxx | 32 |
1 files changed, 26 insertions, 6 deletions
diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx index 43a15635ba9d..d03f1226aab9 100644 --- a/hwpfilter/source/hwpread.cxx +++ b/hwpfilter/source/hwpread.cxx @@ -365,6 +365,28 @@ bool TxtBox::Read(HWPFile & hwpf) return !hwpf.State(); } +namespace +{ + class ChangeMemGuard + { + private: + HIODev* m_pOldMem; + HIODev* m_pNewMem; + public: + ChangeMemGuard(HMemIODev* pNewMem) + : m_pOldMem(hmem) + , m_pNewMem(pNewMem) + { + hmem = m_pNewMem; + } + ~ChangeMemGuard() + { + assert(hmem == m_pNewMem); + hmem = m_pOldMem; + } + }; +} + // picture(11) bool Picture::Read(HWPFile & hwpf) { @@ -467,14 +489,12 @@ bool Picture::Read(HWPFile & hwpf) if (pictype == PICTYPE_DRAW) { - HIODev* pOldMem = hmem; - std::unique_ptr<HMemIODev> pNewMem(new HMemIODev(reinterpret_cast<char *>(follow.data()), follow_block_size)); - hmem = pNewMem.get(); + auto xNewMem(std::make_unique<HMemIODev>(reinterpret_cast<char*>(follow.data()), follow_block_size)); + auto xGuard(std::make_unique<ChangeMemGuard>(xNewMem.get())); LoadDrawingObjectBlock(this); style.cell = picinfo.picdraw.hdo; - assert(hmem == pNewMem.get()); - pNewMem.reset(); - hmem = pOldMem; + xGuard.reset(); + xNewMem.reset(); } else if (follow_block_size >= 4) { |