[Libreoffice-commits] .: Branch 'libreoffice-3-5' - writerfilter/source

[Petr Mladek]

 writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

New commits:
commit 75fce8a65679a9383b139f3f9866a43ac7bda803
Author: Tor Lillqvist <tlillqvist at suse.com>
Date:   Mon Mar 12 15:19:14 2012 +0200

    Fix crash with document from bnc#693238
    
    Signed-off-by: Cedric Bosdonnat <cbosdonnat at suse.com>

diff --git a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx
index 52dd4b7..5353d84 100644
--- a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx
+++ b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx
@@ -424,10 +424,15 @@ OOXMLPropertySetImpl::~OOXMLPropertySetImpl()
 
 void OOXMLPropertySetImpl::resolve(Properties & rHandler)
 {
-    OOXMLProperties_t::iterator aIt = begin();
-    while (aIt != end())
+    size_t nIt = 0;
+
+    // The pProp->resolve(rHandler) call below can cause elements to
+    // be appended to mProperties. I don't think it can cause elements
+    // to be deleted. But let's check with < here just to be safe that
+    // the indexing below works.
+    while (nIt < mProperties.size())
     {
-        OOXMLProperty::Pointer_t pProp = *aIt;
+        OOXMLProperty::Pointer_t pProp = mProperties[nIt];
 
         if (pProp.get() != NULL)
             pProp->resolve(rHandler);
@@ -440,7 +445,7 @@ void OOXMLPropertySetImpl::resolve(Properties & rHandler)
         }
 #endif
 
-        ++aIt;
+        ++nIt;
     }
 }