[Libreoffice-commits] core.git: Branch 'distro/suse/suse-4.0' - sw/source

[Miklos Vajna]

 sw/source/filter/ww8/docxattributeoutput.cxx |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

New commits:
commit 1ab2ca73184a293e6bde95fef59695afb986748d
Author: Miklos Vajna <vmiklos at suse.cz>
Date:   Thu Jun 6 16:35:52 2013 +0200

    bnc#382137 DocxAttributeOutput: don't store address of local variable
    
    AttributeOutputBase::TextField() passes the address of its local
    variable to WriteExpand(), and DocxAttributeOutput::WriteField_Impl()
    stored this. When it was to be used, the variable already went out of
    scope, resulting in a crash. Given that SwField is an abstract base
    class, the easiest way is to just copy the field and manually delete it
    when it's no longer needed.
    
    Change-Id: I9d1fe2485277f1ac21a576d7ff0d05003f0ac8a1
    (cherry picked from commit 248a63f5d0d09b6e8388192a0fe7332a624e8829)

diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index 27bd60f..58d6b0a 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -489,6 +489,8 @@ void DocxAttributeOutput::EndRun()
             // Unknown fields sould be removed too
             if ( !pIt->bClose || ( pIt->eType == ww::eUNKNOWN ) )
             {
+                if (pIt->pField)
+                    delete pIt->pField;
                 pIt = m_Fields.erase( pIt );
                 continue;
             }
@@ -523,6 +525,8 @@ void DocxAttributeOutput::EndRun()
 
             // Remove the field if no end needs to be written
             if ( !pIt->bClose ) {
+                if (pIt->pField)
+                    delete pIt->pField;
                 pIt = m_Fields.erase( pIt );
                 continue;
             }
@@ -570,6 +574,8 @@ void DocxAttributeOutput::EndRun()
     while ( m_Fields.begin() != m_Fields.end() )
     {
         EndField_Impl( m_Fields.front( ) );
+        if (m_Fields.front().pField)
+            delete m_Fields.front().pField;
         m_Fields.erase( m_Fields.begin( ) );
     }
 
@@ -3712,7 +3718,8 @@ void DocxAttributeOutput::WriteExpand( const SwField* pFld )
 void DocxAttributeOutput::WriteField_Impl( const SwField* pFld, ww::eField eType, const String& rFldCmd, sal_uInt8 nMode )
 {
     struct FieldInfos infos;
-    infos.pField = pFld;
+    if (pFld)
+        infos.pField = pFld->CopyField();
     infos.sCmd = rFldCmd;
     infos.eType = eType;
     infos.bClose = WRITEFIELD_CLOSE & nMode;