sw/source/core/crsr/crsrsh.cxx | 4 ++++
1 file changed, 4 insertions(+)
New commits:
commit 43fbe2fbd6a65fa63fa819c6778c3378c2ff6e1f
Author: Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Mon Jan 18 12:35:12 2021 +0100
Commit: Stephan Bergmann <sberg...@redhat.com>
CommitDate: Mon Jan 18 19:17:39 2021 +0100
sw: fix ASAN use-after-free in testTdf39721
The problem is that the cursor is positioned somehow on an SwEndNode.
Then lcl_CursorOk(pNew) is false and it gets deleted immediately.
Change-Id: I1789280a5116da4e5b7739e311b18c5c54074b1f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109541
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
diff --git a/sw/source/core/crsr/crsrsh.cxx b/sw/source/core/crsr/crsrsh.cxx
index 88513297d535..e02b02b9c187 100644
--- a/sw/source/core/crsr/crsrsh.cxx
+++ b/sw/source/core/crsr/crsrsh.cxx
@@ -125,6 +125,10 @@ SwPaM * SwCursorShell::CreateCursor()
// don't create new Cursor with active table Selection
assert(!IsTableMode());
+ // ensure that m_pCurrentCursor is valid; if it's invalid it would be
+ // copied to pNew and then pNew would be deleted in UpdateCursor() below
+ ClearUpCursors();
+
// New cursor as copy of current one. Add to the ring.
// Links point to previously created one, ie forward.
SwShellCursor* pNew = new SwShellCursor( *m_pCurrentCursor );
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
