[Libreoffice-commits] core.git: sw/source

[Libreoffice Gerrit user]

 sw/source/core/crsr/crstrvl.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 1ec8caedace2de2b7e6bf91468301548b54a28a8
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Wed Jan 30 12:16:30 2019 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Wed Jan 30 18:18:41 2019 +0100

    sw: fix use-after-free in SwCursorShell::MoveFieldType()
    
    Change-Id: Ie272373bcef3459b05dc29bf874ecc3fdfa31d4a
    Reviewed-on: https://gerrit.libreoffice.org/67151
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    Tested-by: Jenkins

diff --git a/sw/source/core/crsr/crstrvl.cxx b/sw/source/core/crsr/crstrvl.cxx
index 432436042126..01d046185e61 100644
--- a/sw/source/core/crsr/crstrvl.cxx
+++ b/sw/source/core/crsr/crstrvl.cxx
@@ -804,8 +804,9 @@ bool SwCursorShell::MoveFieldType(
 
         if( bDelField )
         {
-            delete static_cast<SwFormatField*>(&pTextField->GetAttr());
+            auto const pFormat(static_cast<SwFormatField*>(&pTextField->GetAttr()));
             delete pTextField;
+            delete pFormat;
         }
 
         if( it != aSrtLst.end() && isSrch ) // found