[Libreoffice-commits] core.git: Branch 'libreoffice-4-3-6' - sw/source

[Caolán McNamara]

 sw/source/filter/html/htmlcss1.cxx |    4 +++-
 sw/source/filter/html/swhtml.cxx   |    7 ++++++-
 sw/source/filter/html/swhtml.hxx   |    2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

New commits:
commit ce5ba3daffb6f4d109f5c02d49db3c7c08e101ed
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jan 23 11:45:14 2015 +0000

    valgrind invalid read after delete in rhbz499052-1.html
    
    Change-Id: Iecada2f8b6d977cc3f76814e4b2f38895873c362
    (cherry picked from commit ae5410086e6cbe30b8a650b10b4d2250e5e017ec)
    Reviewed-on: https://gerrit.libreoffice.org/14131
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>

diff --git a/sw/source/filter/html/htmlcss1.cxx b/sw/source/filter/html/htmlcss1.cxx
index e4628b6..c09cc86 100644
--- a/sw/source/filter/html/htmlcss1.cxx
+++ b/sw/source/filter/html/htmlcss1.cxx
@@ -2299,7 +2299,9 @@ void SwHTMLParser::InsertParaAttrs( const SfxItemSet& rItemSet )
             if( RES_PARATR_BEGIN > nWhich )
                 (*ppAttr)->SetLikePara();
             aParaAttrs.push_back( *ppAttr );
-            EndAttr( *ppAttr, 0, false );
+            bool bSuccess = EndAttr( *ppAttr, 0, false );
+            if (!bSuccess)
+                aParaAttrs.pop_back();
         }
 
         pItem = aIter.NextItem();
diff --git a/sw/source/filter/html/swhtml.cxx b/sw/source/filter/html/swhtml.cxx
index f6e3e39..0ab6909 100644
--- a/sw/source/filter/html/swhtml.cxx
+++ b/sw/source/filter/html/swhtml.cxx
@@ -2986,9 +2986,11 @@ void SwHTMLParser::NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem )
         (*ppAttr) = new _HTMLAttr( *pPam->GetPoint(), rItem, ppAttr );
 }
 
-void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
+bool SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
                             bool bChkEmpty )
 {
+    bool bRet = true;
+
     OSL_ENSURE( !ppDepAttr, "SwHTMLParser::EndAttr: ppDepAttr-Feature ungetestet?" );
     // Der Listenkopf ist im Attribut gespeichert
     _HTMLAttr **ppHead = pAttr->ppHead;
@@ -3123,6 +3125,7 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
         // leere Attribute in der Prev-Liste befinden, die dann trotzdem
         // gesetzt werden muessen
         _HTMLAttr *pPrev = pAttr->GetPrev();
+        bRet = false;
         delete pAttr;
 
         if( pPrev )
@@ -3150,6 +3153,8 @@ void SwHTMLParser::EndAttr( _HTMLAttr* pAttr, _HTMLAttr **ppDepAttr,
 
     if( bMoveBack )
         pPam->Move( fnMoveForward );
+
+    return bRet;
 }
 
 void SwHTMLParser::DeleteAttr( _HTMLAttr* pAttr )
diff --git a/sw/source/filter/html/swhtml.hxx b/sw/source/filter/html/swhtml.hxx
index cd97cad..39878b0 100644
--- a/sw/source/filter/html/swhtml.hxx
+++ b/sw/source/filter/html/swhtml.hxx
@@ -507,7 +507,7 @@ class SwHTMLParser : public SfxHTMLParser, public SwClient
     // ppDepAttr gibt einen Attribut-Tabellen-Eintrag an, dessen Attribute
     // gesetzt sein muessen, bevor das Attribut beendet werden darf
     void NewAttr( _HTMLAttr **ppAttr, const SfxPoolItem& rItem );
-    void EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0,
+    bool EndAttr( _HTMLAttr *pAttr, _HTMLAttr **ppDepAttr=0,
                   bool bChkEmpty=true );
     void DeleteAttr( _HTMLAttr* pAttr );