[Libreoffice-commits] .: Branch 'libreoffice-3-5' - sw/source

[Libreoffice Gerrit user]

 sw/source/filter/ww8/docxattributeoutput.cxx |   16 ++++++++++------
 sw/source/filter/ww8/docxattributeoutput.hxx |    2 +-
 2 files changed, 11 insertions(+), 7 deletions(-)

New commits:
commit 1f865ac8e35326b01c9f3cb96fea313b53eb812b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Oct 11 12:20:07 2012 +0100

    Resolves: fdo#48569 crash on export to .docx of inline anchored frame
    
    we're currently deferring to the end of the text node to export
    the contents of frames. If its anchored as character then the
    sw::Frame (which is allocated on stack) has gone out of scope
    so this pointer points to junk. Copy it instead.
    
    Sill need to export frames property at some stage.
    
    Change-Id: Ib9f8c6857ce1afe6acba84986b692139e44a7aad
    (cherry picked from commit 60a93729c95d31edab50a905236faa9e38a81556)
    
    Signed-off-by: Eike Rathke <erack at redhat.com>

diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index 100a1e1..24dee9a 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -310,7 +310,10 @@ void DocxAttributeOutput::EndParagraph( ww8::WW8TableNodeInfoInner::Pointer_t pT
     // Write the anchored frame if any
     if ( m_pParentFrame )
     {
-        const SwFrmFmt& rFrmFmt = m_pParentFrame->GetFrmFmt( );
+        sw::Frame *pParentFrame = m_pParentFrame;
+        m_pParentFrame = NULL;
+
+        const SwFrmFmt& rFrmFmt = pParentFrame->GetFrmFmt( );
         const SwNodeIndex* pNodeIndex = rFrmFmt.GetCntnt().GetCntntIdx();
 
         sal_uLong nStt = pNodeIndex ? pNodeIndex->GetIndex()+1                  : 0;
@@ -318,12 +321,13 @@ void DocxAttributeOutput::EndParagraph( ww8::WW8TableNodeInfoInner::Pointer_t pT
 
         m_rExport.SaveData( nStt, nEnd );
 
-        m_rExport.mpParentFrame = m_pParentFrame;
-        m_pParentFrame = NULL;
+        m_rExport.mpParentFrame = pParentFrame;
 
         m_rExport.WriteText( );
 
         m_rExport.RestoreData();
+
+        delete pParentFrame;
     }
 }
 
@@ -2381,8 +2385,8 @@ void DocxAttributeOutput::OutputFlyFrame_Impl( const sw::Frame &rFrame, const Po
             break;
         case sw::Frame::eTxtBox:
             {
-                // The frame output is postponed at the end of the anchor paragraph
-                m_pParentFrame = &rFrame;
+                // The frame output is postponed to the end of the anchor paragraph
+                m_pParentFrame = new sw::Frame(rFrame);
             }
             break;
         case sw::Frame::eOle:
@@ -4380,7 +4384,7 @@ DocxAttributeOutput::~DocxAttributeOutput()
     delete m_pEndnotesList, m_pEndnotesList = NULL;
 
     delete m_pTableWrt, m_pTableWrt = NULL;
-    m_pParentFrame = NULL;
+    delete m_pParentFrame;
 }
 
 DocxExport& DocxAttributeOutput::GetExport()
diff --git a/sw/source/filter/ww8/docxattributeoutput.hxx b/sw/source/filter/ww8/docxattributeoutput.hxx
index 4d1b5a6..4dbe486 100644
--- a/sw/source/filter/ww8/docxattributeoutput.hxx
+++ b/sw/source/filter/ww8/docxattributeoutput.hxx
@@ -586,7 +586,7 @@ private:
     // beginning of the next paragraph
     DocxColBreakStatus m_nColBreakStatus;
 
-    const sw::Frame *m_pParentFrame;
+    sw::Frame *m_pParentFrame;
     // close of hyperlink needed
     bool m_closeHyperlinkInThisRun;
     bool m_closeHyperlinkInPreviousRun;