diff options
author | Caolán McNamara <caolanm@redhat.com> | 2018-01-02 16:09:56 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2018-01-03 14:31:34 +0100 |
commit | dfc72242e5bf67bdd5127bf38ed2ad5b3e49cea3 (patch) | |
tree | 3a64250b88c4f5c5411258307fb3718319569a34 /sw/source | |
parent | 5b7ec49f453c3732e2482b26bce4243eb1a10f40 (diff) |
ofz#4872 Null-dereference READ
we're going to need a bigger boat
Change-Id: Ie4ee3ae1ac9f906ca3faec412bbafc0c6a911aaf
Reviewed-on: https://gerrit.libreoffice.org/47269
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sw/source')
-rw-r--r-- | sw/source/filter/html/htmltab.cxx | 62 |
1 files changed, 51 insertions, 11 deletions
diff --git a/sw/source/filter/html/htmltab.cxx b/sw/source/filter/html/htmltab.cxx index d138e66612db..92ec9aa5c928 100644 --- a/sw/source/filter/html/htmltab.cxx +++ b/sw/source/filter/html/htmltab.cxx @@ -4981,6 +4981,48 @@ HTMLTableOptions::HTMLTableOptions( const HTMLOptions& rOptions, } } +namespace +{ + class FrameDeleteWatch : public SwClient + { + SwFrameFormat* m_pObjectFormat; + bool m_bDeleted; + public: + FrameDeleteWatch(SwFrameFormat* pObjectFormat) + : m_pObjectFormat(pObjectFormat) + , m_bDeleted(false) + { + if (m_pObjectFormat) + m_pObjectFormat->Add(this); + + } + + virtual void SwClientNotify(const SwModify& rModify, const SfxHint& rHint) override + { + SwClient::SwClientNotify(rModify, rHint); + if (auto pDrawFrameFormatHint = dynamic_cast<const sw::DrawFrameFormatHint*>(&rHint)) + { + if (pDrawFrameFormatHint->m_eId == sw::DrawFrameFormatHintId::DYING) + { + m_pObjectFormat->Remove(this); + m_bDeleted = true; + } + } + } + + bool WasDeleted() const + { + return m_bDeleted; + } + + virtual ~FrameDeleteWatch() override + { + if (!m_bDeleted && m_pObjectFormat) + m_pObjectFormat->Remove(this); + } + }; +} + std::shared_ptr<HTMLTable> SwHTMLParser::BuildTable(SvxAdjust eParentAdjust, bool bIsParentHead, bool bHasParentSection, @@ -5250,20 +5292,18 @@ std::shared_ptr<HTMLTable> SwHTMLParser::BuildTable(SvxAdjust eParentAdjust, //if section to be deleted contains a pending m_pMarquee, it will be deleted //so clear m_pMarquee pointer if that's the case SwFrameFormat* pObjectFormat = m_pMarquee ? ::FindFrameFormat(m_pMarquee) : nullptr; - if (pObjectFormat) - { - const SwFormatAnchor& rAnch = pObjectFormat->GetAnchor(); - if (const SwPosition* pPos = rAnch.GetContentAnchor()) - { - SwNodeIndex aMarqueeNodeIndex(pPos->nNode); - SwNodeIndex aSttIdx(*pSttNd), aEndIdx(*pSttNd->EndOfSectionNode()); - if (aMarqueeNodeIndex >= aSttIdx && aMarqueeNodeIndex <= aEndIdx) - m_pMarquee = nullptr; - } - } + FrameDeleteWatch aWatch(pObjectFormat); m_xDoc->getIDocumentContentOperations().DeleteSection(pSttNd); xCurTable->SetCaption( nullptr, false ); + + if (pObjectFormat) + { + if (aWatch.WasDeleted()) + m_pMarquee = nullptr; + else + pObjectFormat->Remove(&aWatch); + } } } |