fix Invalid Read on conversion of ooo95991-1.odt to pdf

"Prepare" can delete the Portion belonging to the SwTxtFrm
and replace it. Prepare knows this and re-fetches it if
that happens. But Prepare can call itself and the outermost
Prepare doesn't know that the innermost Prepare replaced
the SwTxtFrm (and re-fetched it for the remainer of the
innermost Prepare).

So bubble out that it was re-fetched so the outer most
one re-fetches too

Invalid read of size 1

SwParaPortion::SetPrep(bool) (porlay.hxx:299)
SwTextFrm::Prepare(PrepareHint, void const*, bool) (txtfrm.cxx:1805)
SwContentFrm::MakeAll() (calcmove.cxx:1317)
SwFrm::PrepareMake() (calcmove.cxx:340)
SwFrm::Calc() const (frame.hxx:1004)
CalcContent(SwLayoutFrm*, bool, bool) (fly.cxx:1465)
SwLayoutFrm::FormatWidthCols(SwBorderAttrs const&, long, long) (wsfrm.cxx:3306)

 Address 0x2137c850 is 832 bytes inside a block of size 840 free'd
free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
rtl_freeMemory_SYSTEM(void*) (alloc_global.cxx:277)
rtl_freeMemory (alloc_global.cxx:347)
rtl_cache_free (alloc_cache.cxx:1222)
FixedMemPool::Free(void*) (mempool.cxx:48)
SwParaPortion::operator delete(void*, unsigned long) (in /home/caolan/LibreOffice/core/instdir/program/libswlo.so)
SwParaPortion::~SwParaPortion() (porlay.cxx:1967)
SwTextFrm::ClearPara() (txtcache.cxx:106)
SwTextFrm::Init() (txtfrm.cxx:339)
SwTextFrm::CalcLineSpace() (txtfrm.cxx:792)
SwTextFrm::Prepare(PrepareHint, void const*, bool) (txtfrm.cxx:1724)
SwTextFrm::Prepare(PrepareHint, void const*, bool) (txtfrm.cxx:1706)
SwContentFrm::MakeAll() (calcmove.cxx:1317)
SwFrm::PrepareMake() (calcmove.cxx:340)
SwFrm::Calc() const (frame.hxx:1004)
CalcContent(SwLayoutFrm*, bool, bool) (fly.cxx:1465)
SwLayoutFrm::FormatWidthCols(SwBorderAttrs const&, long, long) (wsfrm.cxx:3306)

Change-Id: I1fdade2846e3cbd2e73be1f58d2597e9358fa0ea

1 files changed, 4 insertions, 1 deletions

diff --git a/sw/source/core/inc/txtfrm.hxx b/sw/source/core/inc/txtfrm.hxx
index 034b2bee5361..7bfa6920dd8d 100644
--- a/sw/source/core/inc/txtfrm.hxx
+++ b/sw/source/core/inc/txtfrm.hxx
@@ -342,8 +342,11 @@ public:
      * SwContentFrm: the shortcut for the Frames
      * If the void* casts wrongly, it's its own fault!
      * The void* must be checked for 0 in any case!
+     *
+     * return true if the Portion associated with this SwTxtFrm was
+     * potentially destroyed and replaced by Prepare
      */
-    virtual void Prepare( const PrepareHint ePrep = PREP_CLEAR,
+    virtual bool Prepare( const PrepareHint ePrep = PREP_CLEAR,
                           const void *pVoid = 0, bool bNotify = true ) SAL_OVERRIDE;
 
     /**