[Libreoffice-commits] core.git: Branch 'libreoffice-6-4' - sw/source

[Caolán McNamara (via logerrit)]

 sw/source/filter/ww8/ww8par.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit b25007aa3df29ca1b2af19dc12079cdf14a558bd
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Aug 23 20:47:00 2020 +0100
Commit:     Michael Stahl <michael.stahl at cib.de>
CommitDate: Mon Aug 24 12:19:48 2020 +0200

    ofz#25169 insertion into set might find a duplicate
    
    in which case pImpRec is deleted and pImpRecTmp is invalid
    
    Change-Id: I2a273a436ebd88cb53e329bbcb4f171dda6ed840
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/101155
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.stahl at cib.de>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 17d30a0e9236..166df718c720 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -1076,7 +1076,9 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
 
         if( pImpRec->nShapeId )
         {
-            auto pImpRecTmp = pImpRec.get();
+            auto nShapeId = pImpRec->nShapeId;
+            auto nShapeOrder = (static_cast<sal_uLong>(pImpRec->aTextId.nTxBxS) << 16)
+                                    + pImpRec->aTextId.nSequence;
             // Complement Import Record List
             pImpRec->pObj = pObj;
             rImportData.insert(std::move(pImpRec));
@@ -1088,9 +1090,9 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
                 ( (rObjData.nSpFlags & ShapeFlag::Group)
                  && (rObjData.nCalledByGroup < 2) )
               )
-                StoreShapeOrder( pImpRecTmp->nShapeId,
-                                ( static_cast<sal_uLong>(pImpRecTmp->aTextId.nTxBxS) << 16 )
-                                    + pImpRecTmp->aTextId.nSequence, pObj );
+            {
+                StoreShapeOrder(nShapeId, nShapeOrder, pObj);
+            }
         }
         else
             pImpRec.reset();