diff options
author | Eike Rathke [er] <erAck@sun.com> | 2010-07-02 13:51:34 +0200 |
---|---|---|
committer | Eike Rathke [er] <erAck@sun.com> | 2010-07-02 13:51:34 +0200 |
commit | da291caaae96e0e46cd6891746587528cbbdd925 (patch) | |
tree | f2d5b4eefcb6d98bae4c9f831f2f98aa6d46055f /sc/source/core/data/bcaslot.cxx | |
parent | df61240acdb6cf89e2b2c1895ba293eb78e0d973 (diff) |
calc56: #i112849# Prevent hash from accessing dangling pointers
Diffstat (limited to 'sc/source/core/data/bcaslot.cxx')
-rw-r--r-- | sc/source/core/data/bcaslot.cxx | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/sc/source/core/data/bcaslot.cxx b/sc/source/core/data/bcaslot.cxx index 95482b1c624b..540fb577a79b 100644 --- a/sc/source/core/data/bcaslot.cxx +++ b/sc/source/core/data/bcaslot.cxx @@ -136,10 +136,16 @@ ScBroadcastAreaSlot::ScBroadcastAreaSlot( ScDocument* pDocument, ScBroadcastAreaSlot::~ScBroadcastAreaSlot() { for ( ScBroadcastAreas::iterator aIter( aBroadcastAreaTbl.begin()); - aIter != aBroadcastAreaTbl.end(); ++aIter) + aIter != aBroadcastAreaTbl.end(); /* none */) { - if (!(*aIter)->DecRef()) - delete *aIter; + // Prevent hash from accessing dangling pointer in case area is + // deleted. + ScBroadcastArea* pArea = *aIter; + // Erase all so no hash will be accessed upon destruction of the + // hash_set. + aBroadcastAreaTbl.erase( aIter++); + if (!pArea->DecRef()) + delete pArea; } } |