[Libreoffice-commits] core.git: sd/source

[Caolán McNamara (via logerrit)]

 sd/source/ui/view/sdview3.cxx |   14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

New commits:
commit 1ebc9435849430c61bf41e48a84255a17152fbc9
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jul 17 20:43:09 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Jul 18 11:43:26 2019 +0200

    cid#1448534 Use after free
    
    Change-Id: Ibef20405d1ecf00b71ca12e43902ccd65c873ed2
    Reviewed-on: https://gerrit.libreoffice.org/75815
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sd/source/ui/view/sdview3.cxx b/sd/source/ui/view/sdview3.cxx
index 98167637628d..a5ef90d7f7c6 100644
--- a/sd/source/ui/view/sdview3.cxx
+++ b/sd/source/ui/view/sdview3.cxx
@@ -1175,14 +1175,16 @@ bool View::InsertData( const TransferableDataHelper& rDataHelper,
                             nOptions |= SdrInsertFlags::DONTMARK;
                     }
 
-                    InsertObjectAtView( pObj, *pPV, nOptions );
+                    bReturn = InsertObjectAtView( pObj, *pPV, nOptions );
 
-                    if( pImageMap )
-                        pObj->AppendUserData( std::unique_ptr<SdrObjUserData>(new SdIMapInfo( *pImageMap )) );
+                    if (bReturn)
+                    {
+                        if( pImageMap )
+                            pObj->AppendUserData( std::unique_ptr<SdrObjUserData>(new SdIMapInfo( *pImageMap )) );
 
-                    // let the object stay in loaded state after insertion
-                    pObj->Unload();
-                    bReturn = true;
+                        // let the object stay in loaded state after insertion
+                        pObj->Unload();
+                    }
                 }
             }
         }