• Jochen Nitschke's avatar
    tdf#106424 fix crash in SfxItemPool::Put · 6d51bb3d
    Jochen Nitschke yazdı
    This fix reverts commit	304d3856
    Date:   Wed Oct 16 07:55:09 2002 +0000
        #103124# possible unremoved SwFmt object fixed
    
    and commit fab98924
    Date:   Wed Oct 16 10:18:26 2002 +0000
        #103152# possible unremoved SwFmt object fixed
    
    as they are causing crashes:
    http://crashreport.libreoffice.org/stats/signature
    /SfxItemPool::Put(SfxPoolItem%20const%20&,unsigned%20short)
    
    The comments suggest there was/is a use-after-free when
    SwFormatCharFormat is changed with API. This happens in unoobj.cxx
    and unostyle.cxx by SwFormatDrop::SetCharFormat().
    
    With following changes:
    commit bf2ae97a
        INTEGRATION: CWS os7 (1.64.4.3.34); FILE MERGED
        2003/03/25 14:23:43 os 1.64.4.3.34.1: #104245# table mode added
        to the SwXTextCursor::SetPropertyValue attribute list; 'Standard'
        character format not allowed as drop cap char style
    and commit 9625366d
        INTEGRATION: CWS os8 (1.64.4.3.48); FILE MERGED
        2003/04/09 09:11:53 os 1.64.4.3.48.3: #104245# Default not
        allowed as DropCapCharStyleName, too
    
    in unoobj.cxx, setting the documents' default SwFormatCharFormat is
    rejected by throwing an exception. Likely to fix the same issue as
    the first 2 commits.
    So we do the same in unostyle.cxx now too.
    
    Add an assert in SwFormatCharFormat::SetCharFormat and
    SwFormatDrop::SetCharFormat, to uncover other changes to the default
    SwFormatCharFormat or SwFormatDrop.
    Such an case could happen in SwXTextDefaults::setPropertyValue
    where we bail out now.
    
    Change-Id: Iac59dffbd6285dd28d1000a8eacda8ffd3bdc962
    Reviewed-on: https://gerrit.libreoffice.org/37499Tested-by: 's avatarJenkins <ci@libreoffice.org>
    Reviewed-by: 's avatarMichael Stahl <mstahl@redhat.com>
    6d51bb3d
fchrfmt.hxx 2.85 KB