[Libreoffice-commits] core.git: sd/source

[Caolán McNamara (via logerrit)]

 sd/source/ui/view/sdview4.cxx |   19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

New commits:
commit 9fa09e7a14c990e36e9eba7350fd2015e6b7082c
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Jul 20 15:44:01 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sat Jul 20 20:36:36 2019 +0200

    cid#1448403 Use after free
    
    Change-Id: Ie63c336da7296ecad6aef56d57b064e450361b5d
    Reviewed-on: https://gerrit.libreoffice.org/76020
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sd/source/ui/view/sdview4.cxx b/sd/source/ui/view/sdview4.cxx
index 93d88afb7028..030468fd8271 100644
--- a/sd/source/ui/view/sdview4.cxx
+++ b/sd/source/ui/view/sdview4.cxx
@@ -360,20 +360,27 @@ SdrMediaObj* View::InsertMediaObj( const OUString& rMediaURL, const OUString& rM
         if( pPickObj )
             ReplaceObjectAtView(pPickObj, *pPV, pNewMediaObj);
         else
-            InsertObjectAtView( pNewMediaObj, *pPV, SdrInsertFlags::SETDEFLAYER );
+        {
+            if (!InsertObjectAtView(pNewMediaObj, *pPV, SdrInsertFlags::SETDEFLAYER))
+                pNewMediaObj = nullptr;
+        }
 
         OUString referer;
         DrawDocShell * sh = GetDocSh();
         if (sh != nullptr && sh->HasName()) {
             referer = sh->GetMedium()->GetName();
         }
-        pNewMediaObj->setURL( rMediaURL, referer, rMimeType );
 
-        if( pPickObj )
+        if (pNewMediaObj)
         {
-            pNewMediaObj->AdjustToMaxRect( aRect );
-            if( bIsPres )
-                pNewMediaObj->SetUserCall( pUserCall );
+            pNewMediaObj->setURL( rMediaURL, referer, rMimeType );
+
+            if( pPickObj )
+            {
+                pNewMediaObj->AdjustToMaxRect( aRect );
+                if( bIsPres )
+                    pNewMediaObj->SetUserCall( pUserCall );
+            }
         }
     }