[Libreoffice-commits] core.git: Branch 'libreoffice-6-2' - sw/source

[Libreoffice Gerrit user]

 sw/source/core/crsr/crstrvl.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 56367e1aa96dde131446681fbb8bf6ec694438c5
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Wed Jan 30 12:16:30 2019 +0100
Commit:     Thorsten Behrens <Thorsten.Behrens at CIB.de>
CommitDate: Fri Feb 1 09:30:59 2019 +0100

    sw: fix use-after-free in SwCursorShell::MoveFieldType()
    
    Change-Id: Ie272373bcef3459b05dc29bf874ecc3fdfa31d4a
    Reviewed-on: https://gerrit.libreoffice.org/67151
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    Tested-by: Jenkins
    (cherry picked from commit 1ec8caedace2de2b7e6bf91468301548b54a28a8)
    Reviewed-on: https://gerrit.libreoffice.org/67171
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>

diff --git a/sw/source/core/crsr/crstrvl.cxx b/sw/source/core/crsr/crstrvl.cxx
index 723409bc0255..31aaf8b9374e 100644
--- a/sw/source/core/crsr/crstrvl.cxx
+++ b/sw/source/core/crsr/crstrvl.cxx
@@ -805,8 +805,9 @@ bool SwCursorShell::MoveFieldType(
 
         if( bDelField )
         {
-            delete static_cast<SwFormatField*>(&pTextField->GetAttr());
+            auto const pFormat(static_cast<SwFormatField*>(&pTextField->GetAttr()));
             delete pTextField;
+            delete pFormat;
         }
 
         if( it != aSrtLst.end() && isSrch ) // found