[Libreoffice-commits] core.git: Branch 'libreoffice-7-0-1' - sw/source

[Caolán McNamara (via logerrit)]

 sw/source/filter/ww8/ww8par.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit 804187175a0fafb9f763c09786ab4db857614049
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Aug 23 20:47:00 2020 +0100
Commit:     Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
CommitDate: Thu Aug 27 16:36:56 2020 +0200

    ofz#25169 insertion into set might find a duplicate
    
    in which case pImpRec is deleted and pImpRecTmp is invalid
    
    Change-Id: I2a273a436ebd88cb53e329bbcb4f171dda6ed840
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/101156
    Reviewed-by: Michael Stahl <michael.stahl at cib.de>
    Reviewed-by: Adolfo Jayme Barrientos <fitojb at ubuntu.com>
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    Tested-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 054b0a98e9ee..b733cad8ce83 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -1082,7 +1082,9 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
 
         if( pImpRec->nShapeId )
         {
-            auto pImpRecTmp = pImpRec.get();
+            auto nShapeId = pImpRec->nShapeId;
+            auto nShapeOrder = (static_cast<sal_uLong>(pImpRec->aTextId.nTxBxS) << 16)
+                                    + pImpRec->aTextId.nSequence;
             // Complement Import Record List
             pImpRec->pObj = pObj;
             rImportData.insert(std::move(pImpRec));
@@ -1094,9 +1096,9 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
                 ( (rObjData.nSpFlags & ShapeFlag::Group)
                  && (rObjData.nCalledByGroup < 2) )
               )
-                StoreShapeOrder( pImpRecTmp->nShapeId,
-                                ( static_cast<sal_uLong>(pImpRecTmp->aTextId.nTxBxS) << 16 )
-                                    + pImpRecTmp->aTextId.nSequence, pObj );
+            {
+                StoreShapeOrder(nShapeId, nShapeOrder, pObj);
+            }
         }
         else
             pImpRec.reset();