[Libreoffice-commits] core.git: vcl/unx

[Matthew J. Francis]

 vcl/unx/gtk/window/gtksalmenu.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 7fc08970894aea2b771bf7be409b72845c96d10a
Author: Matthew J. Francis <mjay.francis at gmail.com>
Date:   Thu Sep 18 18:33:00 2014 +0800

    fdo#69090 Avoid using a string after free
    
    Change-Id: I9020b595e434b4de8aa6a14c20d6c98fa619b96a
    Reviewed-on: https://gerrit.libreoffice.org/11502
    Reviewed-by: Tor Lillqvist <tml at collabora.com>
    Tested-by: Tor Lillqvist <tml at collabora.com>

diff --git a/vcl/unx/gtk/window/gtksalmenu.cxx b/vcl/unx/gtk/window/gtksalmenu.cxx
index 05563a1..6622545 100644
--- a/vcl/unx/gtk/window/gtksalmenu.cxx
+++ b/vcl/unx/gtk/window/gtksalmenu.cxx
@@ -702,7 +702,11 @@ GtkSalMenu* GtkSalMenu::GetMenuForItemCommand( gchar* aCommand, gboolean bGetSub
         GtkSalMenuItem *pSalItem = maItems[ nPos ];
 
         OUString aItemCommand = mpVCLMenu->GetItemCommand( pSalItem->mnId );
-        gchar* aItemCommandStr = (gchar*) OUStringToOString( aItemCommand, RTL_TEXTENCODING_UTF8 ).getStr();
+        // Do not join the following two lines, or the OString will be destroyed
+        // immediately, and the gchar* pointed to by aItemCommandStr will be
+        // freed before it can be used - fdo#69090
+        OString aItemCommandOStr = OUStringToOString( aItemCommand, RTL_TEXTENCODING_UTF8 );
+        gchar* aItemCommandStr = (gchar*) aItemCommandOStr.getStr();
 
         if ( g_strcmp0( aItemCommandStr, aCommand ) == 0 )
         {