[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - sw/source

[Caolán McNamara]

 sw/source/filter/html/htmlcss1.cxx |    4 +++-
 sw/source/filter/html/swhtml.cxx   |    7 ++++++-
 sw/source/filter/html/swhtml.hxx   |    2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

New commits:
commit 366add0ee3cb0a41181332d5d59c742282b23d09
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jan 23 11:45:14 2015 +0000

    valgrind invalid read after delete in rhbz499052-1.html
    
    Change-Id: Iecada2f8b6d977cc3f76814e4b2f38895873c362
    (cherry picked from commit ae5410086e6cbe30b8a650b10b4d2250e5e017ec)
    Reviewed-on: https://gerrit.libreoffice.org/14128
    Tested-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/source/filter/html/htmlcss1.cxx b/sw/source/filter/html/htmlcss1.cxx
index 74b2829..5edabfe 100644
--- a/sw/source/filter/html/htmlcss1.cxx
+++ b/sw/source/filter/html/htmlcss1.cxx
@@ -2298,7 +2298,9 @@ void SwHTMLParser::InsertParaAttrs( const SfxItemSet& rItemSet )
             if( RES_PARATR_BEGIN > nWhich )
                 (*ppAttr)->SetLikePara();
             aParaAttrs.push_back( *ppAttr );
-            EndAttr( *ppAttr, 0, false );
+            bool bSuccess = EndAttr( *ppAttr, 0, false );
+            if (!bSuccess)
+                aParaAttrs.pop_back();
         }
 
         pItem = aIter.NextItem();
diff --git a/sw/source/filter/html/swhtml.cxx b/sw/source/filter/html/swhtml.cxx
index e0f929b..0c79426 100644
--- a/sw/source/filter/html/swhtml.cxx
+++ b/sw/source/filter/html/swhtml.cxx
@@ -3001,9 +3001,11 @@ void SwHTMLParser::NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem )
         (*ppAttr) = new _HTMLAttr( *pPam->GetPoint(), rItem, ppAttr );
 }
 
-void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
+bool SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
                             bool bChkEmpty )
 {
+    bool bRet = true;
+
     OSL_ENSURE( !ppDepAttr, "SwHTMLParser::EndAttr: ppDepAttr-Feature ungetestet?" );
     // Der Listenkopf ist im Attribut gespeichert
     _HTMLAttr **ppHead = pAttr->ppHead;
@@ -3138,6 +3140,7 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
         // leere Attribute in der Prev-Liste befinden, die dann trotzdem
         // gesetzt werden muessen
         _HTMLAttr *pPrev = pAttr->GetPrev();
+        bRet = false;
         delete pAttr;
 
         if( pPrev )
@@ -3165,6 +3168,8 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
 
     if( bMoveBack )
         pPam->Move( fnMoveForward );
+
+    return bRet;
 }
 
 void SwHTMLParser::DeleteAttr( _HTMLAttr* pAttr )
diff --git a/sw/source/filter/html/swhtml.hxx b/sw/source/filter/html/swhtml.hxx
index 2f17b75..bd66f83 100644
--- a/sw/source/filter/html/swhtml.hxx
+++ b/sw/source/filter/html/swhtml.hxx
@@ -507,7 +507,7 @@ class SwHTMLParser : public SfxHTMLParser, public SwClient
     // ppDepAttr gibt einen Attribut-Tabellen-Eintrag an, dessen Attribute
     // gesetzt sein muessen, bevor das Attribut beendet werden darf
     void NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem );
-    void EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0,
+    bool EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0,
                   bool bChkEmpty=true );
     void DeleteAttr( _HTMLAttr* pAttr );