[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - filter/source

[Caolán McNamara]

 filter/source/msfilter/svdfppt.cxx |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

New commits:
commit 958280a0332d1f9b3e702c79df6cb9b35eeb350c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Mar 16 21:22:36 2017 +0000

    ofz: use after free
    
    Change-Id: I6d3f9108b02149165b020fc9c6677880456a1ef4
    Reviewed-on: https://gerrit.libreoffice.org/35299
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 4195188fe2be..27b38ad536c1 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2905,7 +2905,18 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                             // obsolete here, too.
                             pRet->getSdrPageProperties().ClearItem();
                             pRet->getSdrPageProperties().PutItemSet(rSlidePersist.pBObj->GetMergedItemSet());
-                            SdrObject::Free( rSlidePersist.pBObj );
+                            if (rSlidePersist.pSolverContainer)
+                            {
+                                for (SvxMSDffConnectorRule* pPtr : rSlidePersist.pSolverContainer->aCList)
+                                {
+                                    // check connections to the group object
+                                    if (pPtr->pAObj == rSlidePersist.pBObj)
+                                        pPtr->pAObj = nullptr;
+                                    if (pPtr->pBObj == rSlidePersist.pBObj)
+                                        pPtr->pBObj = nullptr;
+                                }
+                            }
+                            SdrObject::Free(rSlidePersist.pBObj);
                         }
                     }
                 }