diff options
| author | Miklos Vajna <vmiklos@collabora.co.uk> | 2018-01-15 22:29:31 +0100 |
|---|---|---|
| committer | Miklos Vajna <vmiklos@collabora.co.uk> | 2018-01-16 13:36:02 +0100 |
| commit | ecd855794b22c0f7e6fb2f362b566c4d9c5f624a (patch) | |
| tree | 5f83a902cb9efefc5288aed727beee6538e0d1a7 /sax | |
| parent | Fix typos (diff) | |
| download | core-ecd855794b22c0f7e6fb2f362b566c4d9c5f624a.tar.gz core-ecd855794b22c0f7e6fb2f362b566c4d9c5f624a.zip | |
tdf#114536 sw: fix use-after-free in SwTextFormatter::MergeCharacterBorder()
SwTextFormatter::Underflow() truncated a line portion, which deletes the
rest of the line portions, but left m_pFirstOfBorderMerge unchanged,
leading to a crash when SwTextFormatter::MergeCharacterBorder() tried to
access it.
Fix the problem by updating the non-owning m_pFirstOfBorderMerge
accordingly when truncating the line portion.
Change-Id: I5e445bbe2424d70d60c363fa4e3a00636e282325
Reviewed-on: https://gerrit.libreoffice.org/47923
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Jenkins <ci@libreoffice.org>
Diffstat (limited to 'sax')
0 files changed, 0 insertions, 0 deletions