From b68f06287d34833a59841b8000641a02d0994eb8 Mon Sep 17 00:00:00 2001 From: Tor Lillqvist Date: Mon, 12 Mar 2012 15:19:14 +0200 Subject: Fix crash with document from bnc#693238 --- writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx index 505f5c326816..b0a0c5d90aad 100644 --- a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx +++ b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx @@ -424,10 +424,15 @@ OOXMLPropertySetImpl::~OOXMLPropertySetImpl() void OOXMLPropertySetImpl::resolve(Properties & rHandler) { - OOXMLProperties_t::iterator aIt = begin(); - while (aIt != end()) + size_t nIt = 0; + + // The pProp->resolve(rHandler) call below can cause elements to + // be appended to mProperties. I don't think it can cause elements + // to be deleted. But let's check with < here just to be safe that + // the indexing below works. + while (nIt < mProperties.size()) { - OOXMLProperty::Pointer_t pProp = *aIt; + OOXMLProperty::Pointer_t pProp = mProperties[nIt]; if (pProp.get() != NULL) pProp->resolve(rHandler); @@ -440,7 +445,7 @@ void OOXMLPropertySetImpl::resolve(Properties & rHandler) } #endif - ++aIt; + ++nIt; } } -- cgit v1.2.3