[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/core/layout/ssfrm.cxx |   26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

New commits:
commit 4de09a9efdb62cf90ce18662852e556cf7148e14
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Dec 10 17:12:08 2014 +0000

    coverity#738980 Use after free
    
    Change-Id: I30657eb609a9d02217238dd37a3f23e05168569c

diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index dbda7c1..02f834f 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -457,7 +457,10 @@ void SwLayoutFrm::Destroy()
                 // #i28701#
                 SwAnchoredObject* pAnchoredObj = (*pFrm->GetDrawObjs())[0];
                 if ( pAnchoredObj->ISA(SwFlyFrm) )
+                {
                     delete pAnchoredObj;
+                    assert(!pFrm->GetDrawObjs() || nCnt > pFrm->GetDrawObjs()->size());
+                }
                 else
                 {
                     SdrObject* pSdrObj = pAnchoredObj->DrawObj();
@@ -469,11 +472,12 @@ void SwLayoutFrm::Destroy()
                     {
                         pContact->DisconnectObjFromLayout( pSdrObj );
                     }
-                }
-                if ( pFrm->GetDrawObjs() &&
-                     nCnt == pFrm->GetDrawObjs()->size() )
-                {
-                    pFrm->GetDrawObjs()->Remove( *pAnchoredObj );
+
+                    if ( pFrm->GetDrawObjs() &&
+                         nCnt == pFrm->GetDrawObjs()->size() )
+                    {
+                        pFrm->GetDrawObjs()->Remove( *pAnchoredObj );
+                    }
                 }
             }
             pFrm->Remove();
@@ -488,7 +492,10 @@ void SwLayoutFrm::Destroy()
             // #i28701#
             SwAnchoredObject* pAnchoredObj = (*GetDrawObjs())[0];
             if ( pAnchoredObj->ISA(SwFlyFrm) )
+            {
                 delete pAnchoredObj;
+                assert(!GetDrawObjs() || nCnt > GetDrawObjs()->size());
+            }
             else
             {
                 SdrObject* pSdrObj = pAnchoredObj->DrawObj();
@@ -500,10 +507,11 @@ void SwLayoutFrm::Destroy()
                 {
                     pContact->DisconnectObjFromLayout( pSdrObj );
                 }
-            }
-            if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() )
-            {
-                GetDrawObjs()->Remove( *pAnchoredObj );
+
+                if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() )
+                {
+                    GetDrawObjs()->Remove( *pAnchoredObj );
+                }
             }
         }
     }