ofz#30005 crash in LwpFribPtr::XFConvert

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110086
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 4e84a42add9c8ac27feb5e49a96e00ffcc8f0bc8)

Change-Id: I4f03c1cd8bc12f3fa09c815837b289ff088c91d3

2 files changed, 20 insertions, 19 deletions

diff --git a/lotuswordpro/source/filter/lwpfribptr.cxx b/lotuswordpro/source/filter/lwpfribptr.cxx
index 902727aef38c..f46cd409a900 100644
--- a/lotuswordpro/source/filter/lwpfribptr.cxx
+++ b/lotuswordpro/source/filter/lwpfribptr.cxx
@@ -85,7 +85,8 @@
 #include <lwpdropcapmgr.hxx>
 
 LwpFribPtr::LwpFribPtr()
-    : m_pFribs(nullptr),m_pXFPara(nullptr),m_pPara(nullptr)
+    : m_pFribs(nullptr)
+    , m_pPara(nullptr)
 {
 }
 
@@ -174,7 +175,7 @@ void LwpFribPtr::XFConvert()
         case FRIB_TAG_TEXT:
         {
             LwpFribText* textFrib= static_cast<LwpFribText*>(pFrib);
-            textFrib->XFConvert(m_pXFPara,m_pPara->GetStory());
+            textFrib->XFConvert(m_pXFPara.get(),m_pPara->GetStory());
         }
             break;
         case FRIB_TAG_TAB:
@@ -246,7 +247,7 @@ void LwpFribPtr::XFConvert()
         case FRIB_TAG_UNICODE3: //fall through
         {
             LwpFribUnicode* unicodeFrib= static_cast<LwpFribUnicode*>(pFrib);
-            unicodeFrib->XFConvert(m_pXFPara,m_pPara->GetStory());
+            unicodeFrib->XFConvert(m_pXFPara.get(), m_pPara->GetStory());
         }
             break;
         case FRIB_TAG_HARDSPACE:
@@ -255,15 +256,15 @@ void LwpFribPtr::XFConvert()
             LwpStory *pStory = m_pPara->GetStory();
             LwpHyperlinkMgr* pHyperlink = pStory ? pStory->GetHyperlinkMgr() : nullptr;
             if (pHyperlink && pHyperlink->GetHyperlinkFlag())
-                pFrib->ConvertHyperLink(m_pXFPara,pHyperlink,sHardSpace);
+                pFrib->ConvertHyperLink(m_pXFPara.get(), pHyperlink,sHardSpace);
             else
-                pFrib->ConvertChars(m_pXFPara,sHardSpace);
+                pFrib->ConvertChars(m_pXFPara.get(), sHardSpace);
         }
             break;
         case FRIB_TAG_SOFTHYPHEN:
         {
             OUString sSoftHyphen(u'\x00ad');
-            pFrib->ConvertChars(m_pXFPara,sSoftHyphen);
+            pFrib->ConvertChars(m_pXFPara.get(), sSoftHyphen);
         }
             break;
         case FRIB_TAG_FRAME:
@@ -275,64 +276,64 @@ void LwpFribPtr::XFConvert()
                 LwpFoundry* pFoundry = m_pPara->GetFoundry();
                 LwpDropcapMgr* pMgr = pFoundry ? pFoundry->GetDropcapMgr() : nullptr;
                 if (pMgr)
-                    pMgr->SetXFPara(m_pXFPara);
+                    pMgr->SetXFPara(m_pXFPara.get());
             }
-            frameFrib->XFConvert(m_pXFPara);
+            frameFrib->XFConvert(m_pXFPara.get());
             break;
         }
         case FRIB_TAG_CHBLOCK:
         {
             LwpFribCHBlock* chbFrib = static_cast<LwpFribCHBlock*>(pFrib);
-            chbFrib->XFConvert(m_pXFPara,m_pPara->GetStory());
+            chbFrib->XFConvert(m_pXFPara.get(),m_pPara->GetStory());
         }
             break;
         case FRIB_TAG_TABLE:
         {
             LwpFribTable* tableFrib = static_cast<LwpFribTable*>(pFrib);
             //tableFrib->XFConvert(m_pPara->GetXFContainer());
-            tableFrib->XFConvert(m_pXFPara);
+            tableFrib->XFConvert(m_pXFPara.get());
         }
             break;
         case FRIB_TAG_BOOKMARK:
         {
             LwpFribBookMark* bookmarkFrib = static_cast<LwpFribBookMark*>(pFrib);
-            bookmarkFrib->XFConvert(m_pXFPara);
+            bookmarkFrib->XFConvert(m_pXFPara.get());
         }
         break;
         case FRIB_TAG_FOOTNOTE:
         {
             LwpFribFootnote* pFootnoteFrib = static_cast<LwpFribFootnote*>(pFrib);
-            pFootnoteFrib->XFConvert(m_pXFPara);
+            pFootnoteFrib->XFConvert(m_pXFPara.get());
             break;
         }
         case FRIB_TAG_FIELD:
         {
             LwpFribField* fieldFrib = static_cast<LwpFribField*>(pFrib);
-            fieldFrib->XFConvert(m_pXFPara);
+            fieldFrib->XFConvert(m_pXFPara.get());
             break;
         }
         case FRIB_TAG_NOTE:
         {
             LwpFribNote* pNoteFrib = static_cast<LwpFribNote*>(pFrib);
-            pNoteFrib->XFConvert(m_pXFPara);
+            pNoteFrib->XFConvert(m_pXFPara.get());
             break;
         }
         case FRIB_TAG_PAGENUMBER:
         {
             LwpFribPageNumber* pagenumFrib = static_cast<LwpFribPageNumber*>(pFrib);
-            pagenumFrib->XFConvert(m_pXFPara);
+            pagenumFrib->XFConvert(m_pXFPara.get());
             break;
         }
         case FRIB_TAG_DOCVAR:
         {
             LwpFribDocVar* docFrib = static_cast<LwpFribDocVar*>(pFrib);
-            docFrib->XFConvert(m_pXFPara);
+            docFrib->XFConvert(m_pXFPara.get());
             break;
         }
         case FRIB_TAG_RUBYMARKER:
         {
             LwpFribRubyMarker* rubyFrib = static_cast<LwpFribRubyMarker*>(pFrib);
-            rubyFrib->XFConvert(m_pXFPara);
+            rubyFrib->XFConvert(m_pXFPara.get());
             break;
         }
         case FRIB_TAG_RUBYFRAME:
diff --git a/lotuswordpro/source/filter/lwpfribptr.hxx b/lotuswordpro/source/filter/lwpfribptr.hxx
index 58cb3fae2079..738d9cf4d887 100644
--- a/lotuswordpro/source/filter/lwpfribptr.hxx
+++ b/lotuswordpro/source/filter/lwpfribptr.hxx
@@ -75,13 +75,13 @@ public:
     void ReadPara(LwpObjectStream* pObjStrm);
 private:
     LwpFrib* m_pFribs;
-    XFParagraph* m_pXFPara;//Current XFPara used for frib parsing
+    rtl::Reference<XFParagraph> m_pXFPara; //Current XFPara used for frib parsing
     LwpPara* m_pPara;//for get foundry
     static void ProcessDropcap(LwpStory* pStory,LwpFrib* pFrib,sal_uInt32 nLen);
 public:
     void XFConvert();
     void SetXFPara(XFParagraph* Para){m_pXFPara = Para;}
-    XFParagraph* GetXFPara(){return m_pXFPara;}
+    XFParagraph* GetXFPara() { return m_pXFPara.get(); }
     void SetPara(LwpPara* para){m_pPara=para;}
     void RegisterStyle();
     LwpFrib* GetFribs(){return m_pFribs;}