[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/msfilter/svdfppt.cxx |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

New commits:
commit 60aac84fc83ca6d527d06cf4ce031d7ef5ffee48
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Mar 16 21:22:36 2017 +0000

    ofz#888: use after free
    
    Change-Id: I6d3f9108b02149165b020fc9c6677880456a1ef4
    Reviewed-on: https://gerrit.libreoffice.org/35298
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index dfd8148bf699..92d9025f75f9 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2934,7 +2934,18 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                             // obsolete here, too.
                             pRet->getSdrPageProperties().ClearItem();
                             pRet->getSdrPageProperties().PutItemSet(rSlidePersist.pBObj->GetMergedItemSet());
-                            SdrObject::Free( rSlidePersist.pBObj );
+                            if (rSlidePersist.pSolverContainer)
+                            {
+                                for (SvxMSDffConnectorRule* pPtr : rSlidePersist.pSolverContainer->aCList)
+                                {
+                                    // check connections to the group object
+                                    if (pPtr->pAObj == rSlidePersist.pBObj)
+                                        pPtr->pAObj = nullptr;
+                                    if (pPtr->pBObj == rSlidePersist.pBObj)
+                                        pPtr->pBObj = nullptr;
+                                }
+                            }
+                            SdrObject::Free(rSlidePersist.pBObj);
                         }
                     }
                 }