[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/rtf/swparrtf.cxx |    9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

New commits:
commit 0832db1330bc44c9442ca9431daf77ff28911f88
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Sep 10 11:38:49 2016 +0100

    fftester: this mode is intended for paste into an existing doc
    
    so rearrange this to avoid (with G_SLICE=always-alloc) use
    after free after the joinnext that expects to be able to safely
    join the last node
    
    ==3439== Invalid read of size 8
    ==3439==    at 0x269362FE: SwIndex::Remove() (index.cxx:165)
    ==3439==    by 0x26885591: SwIndex::~SwIndex() (index.hxx:59)
    ==3439==    by 0x26885829: SwPosition::~SwPosition() (pam.hxx:51)
    ==3439==    by 0x269AAF0D: SwPaM::~SwPaM() (pam.cxx:437)
    ==3439==    by 0x208D9AA5: TestImportRTF (swparrtf.cxx:182)
    ==3439==    by 0x404054: sal_main_with_args(int, char**) (fftester.cxx:384)
    ==3439==    by 0x40230D: main (fftester.cxx:77)
    ==3439==  Address 0x19143e48 is 104 bytes inside a block of size 248 free'd
    ==3439==    at 0x4C2CD5A: free (vg_replace_malloc.c:530)
    ==3439==    by 0x518A7F4: rtl_freeMemory_SYSTEM(void*) (alloc_global.cxx:279)
    ==3439==    by 0x518AAD8: rtl_freeMemory (alloc_global.cxx:349)
    ==3439==    by 0x51895C3: rtl_cache_free (alloc_cache.cxx:1230)
    ==3439==    by 0x4EC7A8D: FixedMemPool::Free(void*) (mempool.cxx:49)
    ==3439==    by 0x26AC52FC: SwTextNode::operator delete(void*, unsigned long) (ndtxt.hxx:799)
    ==3439==    by 0x270BE0C0: SwTextNode::~SwTextNode() (ndtxt.cxx:275)
    ==3439==    by 0x26CC16D1: SwNodes::RemoveNode(unsigned long, unsigned long, bool) (nodes.cxx:2298)
    ==3439==    by 0x26CBD766: SwNodes::Delete(SwNodeIndex const&, unsigned long) (nodes.cxx:1210)
    ==3439==    by 0x270BFB60: SwTextNode::JoinNext() (ndtxt.cxx:715)
    ==3439==    by 0x208D9282: SwRTFReader::Read(SwDoc&, rtl::OUString const&, SwPaM&, rtl::OUString const&) (swparrtf.cxx:128)
    ==3439==    by 0x208D9A3E: TestImportRTF (swparrtf.cxx:187)
    
    Change-Id: I1cf70faae542a56f61fa651d6158774c28462999

diff --git a/sw/source/filter/rtf/swparrtf.cxx b/sw/source/filter/rtf/swparrtf.cxx
index d5928bf..93ebb28 100644
--- a/sw/source/filter/rtf/swparrtf.cxx
+++ b/sw/source/filter/rtf/swparrtf.cxx
@@ -173,17 +173,10 @@ extern "C" SAL_DLLPUBLIC_EXPORT bool SAL_CALL TestImportRTF(const OUString& rURL
     xDocSh->DoInitNew();
     SwDoc* pD =  static_cast<SwDocShell*>((&xDocSh))->GetDoc();
 
-    SwNodeIndex aIdx(
-        *pD->GetNodes().GetEndOfContent().StartOfSectionNode(), 1);
-    if (!aIdx.GetNode().IsTextNode())
-    {
-        pD->GetNodes().GoNext(&aIdx);
-    }
-    SwPaM aPaM(aIdx);
-    aPaM.GetPoint()->nContent.Assign(aIdx.GetNode().GetContentNode(), 0);
     bool bRet = false;
     try
     {
+        SwPaM aPaM(pD->GetNodes().GetEndOfContent());
         bRet = pReader->Read(*pD, OUString(), aPaM, OUString()) == 0;
     }
     catch (std::exception const&)