[Libreoffice-commits] core.git: Branch 'libreoffice-6-1' - sw/source

[Libreoffice Gerrit user]

 sw/source/core/crsr/crstrvl.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit ffccaf2110a25f0b05174e6e9728e4e860c6398b
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Wed Jan 30 12:16:30 2019 +0100
Commit:     Thorsten Behrens <Thorsten.Behrens at CIB.de>
CommitDate: Fri Feb 1 09:31:16 2019 +0100

    sw: fix use-after-free in SwCursorShell::MoveFieldType()
    
    Change-Id: Ie272373bcef3459b05dc29bf874ecc3fdfa31d4a
    Reviewed-on: https://gerrit.libreoffice.org/67151
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    Tested-by: Jenkins
    (cherry picked from commit 1ec8caedace2de2b7e6bf91468301548b54a28a8)
    Reviewed-on: https://gerrit.libreoffice.org/67173
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>

diff --git a/sw/source/core/crsr/crstrvl.cxx b/sw/source/core/crsr/crstrvl.cxx
index cef97092485c..2586ed6483cf 100644
--- a/sw/source/core/crsr/crstrvl.cxx
+++ b/sw/source/core/crsr/crstrvl.cxx
@@ -737,8 +737,9 @@ bool SwCursorShell::MoveFieldType(
 
         if( bDelField )
         {
-            delete static_cast<SwFormatField*>(&pTextField->GetAttr());
+            auto const pFormat(static_cast<SwFormatField*>(&pTextField->GetAttr()));
             delete pTextField;
+            delete pFormat;
         }
 
         if( it != aSrtLst.end() && isSrch ) // found