[Libreoffice-commits] core.git: sw/source

[Norbert Thiebaud]

 sw/source/core/layout/sectfrm.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit f7ddccdac0cedcc32c093de086df0e61416a635b
Author: Norbert Thiebaud <nthiebaud at gmail.com>
Date:   Sun Feb 17 11:43:59 2013 -0600

    coverity#984443 Use after free
    
    Change-Id: I3736de989ab9978ba20883ffcad635729048e4f9
    Reviewed-on: https://gerrit.libreoffice.org/2198
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/core/layout/sectfrm.cxx b/sw/source/core/layout/sectfrm.cxx
index 05676fd..9722b23 100644
--- a/sw/source/core/layout/sectfrm.cxx
+++ b/sw/source/core/layout/sectfrm.cxx
@@ -932,6 +932,10 @@ static SwFtnFrm* lcl_FindEndnote( SwSectionFrm* &rpSect, bool &rbEmpty,
                 SwFtnFrm* pRet = (SwFtnFrm*)pFtnCont->Lower();
                 while( pRet ) // look for endnotes
                 {
+                    /* CollectEndNode can destroy pRet so we need to get the
+                       next early
+                    */
+                    SwFtnFrm* pRetNext = (SwFtnFrm*)pRet->GetNext();
                     if( pRet->GetAttr()->GetFtn().IsEndNote() )
                     {
                         if( pRet->GetMaster() )
@@ -944,7 +948,7 @@ static SwFtnFrm* lcl_FindEndnote( SwSectionFrm* &rpSect, bool &rbEmpty,
                         else
                             return pRet; // Found
                     }
-                    pRet = (SwFtnFrm*)pRet->GetNext();
+                    pRet = pRetNext;
                 }
             }
             pCol = (SwColumnFrm*)pCol->GetNext();