diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-09-08 14:45:38 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-09-08 17:50:17 +0200 |
| commit | 4907cf58bae433b833aa7fedc6a8aafd45e75a75 (patch) | |
| tree | 3a9a2ddad193f7d7517ec0a86544d3e9a32559ca /hwpfilter | |
| parent | cbf8f81156840bffff524d74d02d70a5530a0a37 (diff) | |
ofz#10259 ofz#10263 ofz#10264 ofz#10265 use-after-free
Change-Id: I3e845c21f7a4e853ce9548f2992cab324dec05a8
Reviewed-on: https://gerrit.libreoffice.org/60200
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'hwpfilter')
| -rw-r--r-- | hwpfilter/source/drawing.h | 5 | ||||
| -rw-r--r-- | hwpfilter/source/hwpread.cxx | 2 |
2 files changed, 4 insertions, 3 deletions
diff --git a/hwpfilter/source/drawing.h b/hwpfilter/source/drawing.h index 5c2746da0099..3118ec0c8720 100644 --- a/hwpfilter/source/drawing.h +++ b/hwpfilter/source/drawing.h @@ -85,7 +85,7 @@ HWPDOFuncType HWPDOFuncTbl[] = HWPDOFreeFormFunc, }; -static HMemIODev *hmem = nullptr; +static HIODev *hmem = nullptr; static int count = 0; @@ -631,7 +631,8 @@ static HWPPara *LoadParaList() std::vector< HWPPara* > plist; hwpf->ReadParaList(plist); - hwpf->SetIODevice(std::move(hio)); + std::unique_ptr<HIODev> orighmem = hwpf->SetIODevice(std::move(hio)); + hmem = orighmem.release(); return plist.size()? plist.front() : nullptr; } diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx index 1ed8001513af..9d44a00bc87b 100644 --- a/hwpfilter/source/hwpread.cxx +++ b/hwpfilter/source/hwpread.cxx @@ -460,7 +460,7 @@ bool Picture::Read(HWPFile & hwpf) if (pictype == PICTYPE_DRAW) { - HMemIODev* pOldMem = hmem; + HIODev* pOldMem = hmem; HMemIODev* pNewMem = new HMemIODev(reinterpret_cast<char *>(follow.data()), follow_block_size); hmem = pNewMem; LoadDrawingObjectBlock(this); |