[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/html/htmlcss1.cxx |    4 +++-
 sw/source/filter/html/swhtml.cxx   |    7 ++++++-
 sw/source/filter/html/swhtml.hxx   |    2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

New commits:
commit ae5410086e6cbe30b8a650b10b4d2250e5e017ec
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jan 23 11:45:14 2015 +0000

    valgrind invalid read after delete in rhbz499052-1.html
    
    Change-Id: Iecada2f8b6d977cc3f76814e4b2f38895873c362

diff --git a/sw/source/filter/html/htmlcss1.cxx b/sw/source/filter/html/htmlcss1.cxx
index 2f8e386..1254401 100644
--- a/sw/source/filter/html/htmlcss1.cxx
+++ b/sw/source/filter/html/htmlcss1.cxx
@@ -2298,7 +2298,9 @@ void SwHTMLParser::InsertParaAttrs( const SfxItemSet& rItemSet )
             if( RES_PARATR_BEGIN > nWhich )
                 (*ppAttr)->SetLikePara();
             aParaAttrs.push_back( *ppAttr );
-            EndAttr( *ppAttr, 0, false );
+            bool bSuccess = EndAttr( *ppAttr, 0, false );
+            if (!bSuccess)
+                aParaAttrs.pop_back();
         }
 
         pItem = aIter.NextItem();
diff --git a/sw/source/filter/html/swhtml.cxx b/sw/source/filter/html/swhtml.cxx
index 7a91305..cf7490f 100644
--- a/sw/source/filter/html/swhtml.cxx
+++ b/sw/source/filter/html/swhtml.cxx
@@ -3000,9 +3000,11 @@ void SwHTMLParser::NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem )
         (*ppAttr) = new _HTMLAttr( *pPam->GetPoint(), rItem, ppAttr );
 }
 
-void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
+bool SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
                             bool bChkEmpty )
 {
+    bool bRet = true;
+
     OSL_ENSURE( !ppDepAttr, "SwHTMLParser::EndAttr: ppDepAttr-Feature ungetestet?" );
     // Der Listenkopf ist im Attribut gespeichert
     _HTMLAttr **ppHead = pAttr->ppHead;
@@ -3137,6 +3139,7 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
         // leere Attribute in der Prev-Liste befinden, die dann trotzdem
         // gesetzt werden muessen
         _HTMLAttr *pPrev = pAttr->GetPrev();
+        bRet = false;
         delete pAttr;
 
         if( pPrev )
@@ -3164,6 +3167,8 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
 
     if( bMoveBack )
         pPam->Move( fnMoveForward );
+
+    return bRet;
 }
 
 void SwHTMLParser::DeleteAttr( _HTMLAttr* pAttr )
diff --git a/sw/source/filter/html/swhtml.hxx b/sw/source/filter/html/swhtml.hxx
index d9f7635..a21b28c 100644
--- a/sw/source/filter/html/swhtml.hxx
+++ b/sw/source/filter/html/swhtml.hxx
@@ -509,7 +509,7 @@ class SwHTMLParser : public SfxHTMLParser, public SwClient
     // ppDepAttr gibt einen Attribut-Tabellen-Eintrag an, dessen Attribute
     // gesetzt sein muessen, bevor das Attribut beendet werden darf
     void NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem );
-    void EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0,
+    bool EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0,
                   bool bChkEmpty=true );
     void DeleteAttr( _HTMLAttr* pAttr );