diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-01-23 11:45:14 +0000 |
|---|---|---|
| committer | Michael Stahl <mstahl@redhat.com> | 2015-01-23 12:08:21 +0000 |
| commit | 366add0ee3cb0a41181332d5d59c742282b23d09 (patch) | |
| tree | 96f2aae045ed0e1b0c6d3c802da53d90e2b56f24 /sw | |
| parent | 7aa6bf5a7c89c8d114c84eb24e3056568fb7c9df (diff) | |
valgrind invalid read after delete in rhbz499052-1.html
Change-Id: Iecada2f8b6d977cc3f76814e4b2f38895873c362
(cherry picked from commit ae5410086e6cbe30b8a650b10b4d2250e5e017ec)
Reviewed-on: https://gerrit.libreoffice.org/14128
Tested-by: Michael Stahl <mstahl@redhat.com>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/html/htmlcss1.cxx | 4 | ||||
| -rw-r--r-- | sw/source/filter/html/swhtml.cxx | 7 | ||||
| -rw-r--r-- | sw/source/filter/html/swhtml.hxx | 2 |
3 files changed, 10 insertions, 3 deletions
diff --git a/sw/source/filter/html/htmlcss1.cxx b/sw/source/filter/html/htmlcss1.cxx index 74b2829bb8bb..5edabfe8b277 100644 --- a/sw/source/filter/html/htmlcss1.cxx +++ b/sw/source/filter/html/htmlcss1.cxx @@ -2298,7 +2298,9 @@ void SwHTMLParser::InsertParaAttrs( const SfxItemSet& rItemSet ) if( RES_PARATR_BEGIN > nWhich ) (*ppAttr)->SetLikePara(); aParaAttrs.push_back( *ppAttr ); - EndAttr( *ppAttr, 0, false ); + bool bSuccess = EndAttr( *ppAttr, 0, false ); + if (!bSuccess) + aParaAttrs.pop_back(); } pItem = aIter.NextItem(); diff --git a/sw/source/filter/html/swhtml.cxx b/sw/source/filter/html/swhtml.cxx index e0f929b4c370..0c794268434b 100644 --- a/sw/source/filter/html/swhtml.cxx +++ b/sw/source/filter/html/swhtml.cxx @@ -3001,9 +3001,11 @@ void SwHTMLParser::NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem ) (*ppAttr) = new _HTMLAttr( *pPam->GetPoint(), rItem, ppAttr ); } -void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr, +bool SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr, bool bChkEmpty ) { + bool bRet = true; + OSL_ENSURE( !ppDepAttr, "SwHTMLParser::EndAttr: ppDepAttr-Feature ungetestet?" ); // Der Listenkopf ist im Attribut gespeichert _HTMLAttr **ppHead = pAttr->ppHead; @@ -3138,6 +3140,7 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr, // leere Attribute in der Prev-Liste befinden, die dann trotzdem // gesetzt werden muessen _HTMLAttr *pPrev = pAttr->GetPrev(); + bRet = false; delete pAttr; if( pPrev ) @@ -3165,6 +3168,8 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr, if( bMoveBack ) pPam->Move( fnMoveForward ); + + return bRet; } void SwHTMLParser::DeleteAttr( _HTMLAttr* pAttr ) diff --git a/sw/source/filter/html/swhtml.hxx b/sw/source/filter/html/swhtml.hxx index 2f17b7522d4f..bd66f83e3149 100644 --- a/sw/source/filter/html/swhtml.hxx +++ b/sw/source/filter/html/swhtml.hxx @@ -507,7 +507,7 @@ class SwHTMLParser : public SfxHTMLParser, public SwClient // ppDepAttr gibt einen Attribut-Tabellen-Eintrag an, dessen Attribute // gesetzt sein muessen, bevor das Attribut beendet werden darf void NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem ); - void EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0, + bool EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0, bool bChkEmpty=true ); void DeleteAttr( _HTMLAttr* pAttr ); |