[Libreoffice-commits] .: writerfilter/source

[Tor Lillqvist]

 writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

New commits:
commit b68f06287d34833a59841b8000641a02d0994eb8
Author: Tor Lillqvist <tlillqvist at suse.com>
Date:   Mon Mar 12 15:19:14 2012 +0200

    Fix crash with document from bnc#693238

diff --git a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx
index 505f5c3..b0a0c5d 100644
--- a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx
+++ b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx
@@ -424,10 +424,15 @@ OOXMLPropertySetImpl::~OOXMLPropertySetImpl()
 
 void OOXMLPropertySetImpl::resolve(Properties & rHandler)
 {
-    OOXMLProperties_t::iterator aIt = begin();
-    while (aIt != end())
+    size_t nIt = 0;
+
+    // The pProp->resolve(rHandler) call below can cause elements to
+    // be appended to mProperties. I don't think it can cause elements
+    // to be deleted. But let's check with < here just to be safe that
+    // the indexing below works.
+    while (nIt < mProperties.size())
     {
-        OOXMLProperty::Pointer_t pProp = *aIt;
+        OOXMLProperty::Pointer_t pProp = mProperties[nIt];
 
         if (pProp.get() != NULL)
             pProp->resolve(rHandler);
@@ -440,7 +445,7 @@ void OOXMLPropertySetImpl::resolve(Properties & rHandler)
         }
 #endif
 
-        ++aIt;
+        ++nIt;
     }
 }