[Libreoffice-bugs] [Bug 107494] CRASH: LibreOffice crashes while deleting the header containing an image

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=107494

Michael Stahl <mstahl at redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |regression
             Status|NEW                         |RESOLVED
                 CC|                            |mstahl at redhat.com,
                   |                            |sbergman at redhat.com
            Version|5.4.0.0.alpha0+ Master      |5.0.0.5 release
         Resolution|---                         |FIXED
           Assignee|libreoffice-bugs at lists.free |mstahl at redhat.com
                   |desktop.org                 |

--- Comment #6 from Michael Stahl <mstahl at redhat.com> ---
fixed on master

guess this is when it started to crash:

commit 0f98299f7aa44bbb55c1bfeddca7799f727d14b0
Author:     Stephan Bergmann <sbergman at redhat.com>
AuthorDate: Wed Mar 4 13:52:03 2015 +0100

    Avoid bad downcast of SwFrmFmt to SwSectionFmt

diff --git a/sw/inc/docary.hxx b/sw/inc/docary.hxx
index 098851e..8768cc0 100644
--- a/sw/inc/docary.hxx
+++ b/sw/inc/docary.hxx
@@ -128,8 +128,10 @@ public:

     inline sal_uInt16 GetPos(const SwFmt *p) const
         { return SwVectorModifyBase<Value>::GetPos( static_cast<Value>(
const_cast<SwFmt*>( p ) ) ); }
-    inline bool Contains(const SwFmt *p) const
-        { return SwVectorModifyBase<Value>::Contains( static_cast<Value>(
const_cast<SwFmt*>( p ) ) ); }
+    inline bool Contains(const SwFmt *p) const {
+        Value p2 = dynamic_cast<Value>(const_cast<SwFmt*>(p));
+        return p2 != nullptr && SwVectorModifyBase<Value>::Contains(p2);
+    }
 };

 class SwGrfFmtColls : public SwFmtsModifyBase<SwGrfFmtColl*>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20170428/a4f7d834/attachment-0001.html>