[Libreoffice-commits] core.git: svx/source

[Matthew J. Francis]

 svx/source/tbxctrls/PaletteManager.cxx |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

New commits:
commit 36b25a83fe0b6b0ae0f179bedfc207375633ed19
Author: Matthew J. Francis <mjay.francis at gmail.com>
Date:   Sun Oct 19 16:24:55 2014 +0800

    fdo#85185 Copy OUString argument to avoid a use after free
    
    The original OUString is destroyed along with its containing
    object part way through the call to PaletteManager::PopupColorPicker(),
    so a copy must be taken
    
    Change-Id: I8417ff23a17003e80a4f65e0cf1ad2a8dda5386c
    Reviewed-on: https://gerrit.libreoffice.org/12031
    Reviewed-by: Noel Grandin <noelgrandin at gmail.com>
    Tested-by: Noel Grandin <noelgrandin at gmail.com>

diff --git a/svx/source/tbxctrls/PaletteManager.cxx b/svx/source/tbxctrls/PaletteManager.cxx
index ca4c014..c561a5e 100644
--- a/svx/source/tbxctrls/PaletteManager.cxx
+++ b/svx/source/tbxctrls/PaletteManager.cxx
@@ -197,6 +197,8 @@ void PaletteManager::SetBtnUpdater(svx::ToolboxButtonColorUpdater* pBtnUpdater)
 
 void PaletteManager::PopupColorPicker(const OUString& aCommand)
 {
+    // The calling object goes away during aColorDlg.Execute(), so we must copy this
+    OUString aCommandCopy = aCommand;
     SvColorDialog aColorDlg( 0 );
     aColorDlg.SetColor ( mLastColor );
     aColorDlg.SetMode( svtools::ColorPickerMode_MODIFY );
@@ -206,7 +208,7 @@ void PaletteManager::PopupColorPicker(const OUString& aCommand)
             mpBtnUpdater->Update( aColorDlg.GetColor() );
         mLastColor = aColorDlg.GetColor();
         AddRecentColor( mLastColor );
-        DispatchColorCommand(aCommand, mLastColor);
+        DispatchColorCommand(aCommandCopy, mLastColor);
     }
 }