diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2021-08-18 16:57:18 +0100 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2021-11-17 19:19:34 +0100 |
| commit | cb05fd09ddaf3eac850c1c1f967a89024d2294e3 (patch) | |
| tree | ca73da430240c79b7f71a40c3e61711b1080b56e | |
| parent | crashtesting: UaF on layout of fdo53985-1.docx (diff) | |
| download | core-cb05fd09ddaf3eac850c1c1f967a89024d2294e3.tar.gz core-cb05fd09ddaf3eac850c1c1f967a89024d2294e3.zip | |
ofz#37322 Bad-cast
use a SwUnoCursor for the LastAnchorPos around here, this is similar to
ofz#9858 Bad-cast
Change-Id: I194a39ae13c382740b0ba8145dcc33fb2107105d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/120679
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit c1cd505c67a53a0a27589889b34641612d10946d)
| -rw-r--r-- | sw/qa/core/data/ww5/pass/ooo37322-1-WW2.doc | bin | 0 -> 5559 bytes | |||
| -rw-r--r-- | sw/source/filter/ww8/ww8par.cxx | 9 |
2 files changed, 9 insertions, 0 deletions
diff --git a/sw/qa/core/data/ww5/pass/ooo37322-1-WW2.doc b/sw/qa/core/data/ww5/pass/ooo37322-1-WW2.doc Binary files differnew file mode 100644 index 000000000000..fd64eeed2963 --- /dev/null +++ b/sw/qa/core/data/ww5/pass/ooo37322-1-WW2.doc diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index d23c5b0d7421..5b6f185fdcca 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -2058,8 +2058,17 @@ void WW8ReaderSave::Restore( SwWW8ImplReader* pRdr ) pRdr->m_xRedlineStack->closeall(*pRdr->m_pPaM->GetPoint()); pRdr->m_aFrameRedlines.emplace(std::move(pRdr->m_xRedlineStack)); + + // ofz#37322 drop m_pLastAnchorPos during RedlineStack dtor and restore it afterwards to the same + // place, or somewhere close if that place got destroyed + std::shared_ptr<SwUnoCursor> xLastAnchorCursor(pRdr->m_pLastAnchorPos ? pRdr->m_rDoc.CreateUnoCursor(*pRdr->m_pLastAnchorPos) : nullptr); + pRdr->m_pLastAnchorPos.reset(); + pRdr->m_xRedlineStack = std::move(mxOldRedlines); + if (xLastAnchorCursor) + pRdr->m_pLastAnchorPos.reset(new SwPosition(*xLastAnchorCursor->GetPoint())); + pRdr->DeleteAnchorStack(); pRdr->m_xAnchorStck = std::move(mxOldAnchorStck); |