[Libreoffice-commits] core.git: Branch 'libreoffice-6-1' - sw/source

[Libreoffice Gerrit user]

 sw/source/uibase/utlui/content.cxx |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

New commits:
commit 9968f6bc25c3ec416a6db863a8d8642ae9a26126
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Mon Nov 5 13:41:29 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sat Nov 17 17:44:36 2018 +0100

    sw: fix crash in SwContentTree::HasContentChanged()
    
    Remove() will remove the node including its children, but
    SvTreeList::Next() will actually return the first child, so the pChild
    points to an entry that has been deleted.
    
    Change-Id: Ia4bd75d64c8436ea03c0727a8d49ee0c34fda16f
    (cherry picked from commit cdbe48633f198250e883837dac5d93f93a42888d)
    Reviewed-on: https://gerrit.libreoffice.org/63427
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/uibase/utlui/content.cxx b/sw/source/uibase/utlui/content.cxx
index b6d5946c9b23..9c6c26c1e47b 100644
--- a/sw/source/uibase/utlui/content.cxx
+++ b/sw/source/uibase/utlui/content.cxx
@@ -2187,14 +2187,11 @@ bool SwContentTree::HasContentChanged()
                     }
                     if(bRemoveChildren)
                     {
-                        SvTreeListEntry* pChild = FirstChild(pEntry);
-                        SvTreeListEntry* pRemove = pChild;
                         for(size_t j = 0; j < nChildCount; ++j)
                         {
-                            pChild = Next(pRemove);
+                            SvTreeListEntry *const pRemove = FirstChild(pEntry);
                             assert(pRemove);
                             GetModel()->Remove(pRemove);
-                            pRemove = pChild;
                         }
                     }
                     if(!nChildCount)