clang: Use-after-free

Change-Id: I5dd857dbf39c8cd62df8b8cd0323b873a79976ae

include/sfx2/sfxbasemodel.hxx

@@ -879,7 +879,7 @@ private:
 
     SAL_DLLPRIVATE void loadCmisProperties();
 
-    SAL_DLLPRIVATE void handleLoadError( sal_uInt32 nError, SfxMedium* pMedium );
+    SAL_DLLPRIVATE SfxMedium* handleLoadError( sal_uInt32 nError, SfxMedium* pMedium );
 
 
 //  private variables and methods

sfx2/source/doc/sfxbasemodel.cxx

@@ -1793,6 +1793,9 @@ OUString getFilterProvider( SfxMedium& rMedium )
 
 void setUpdatePickList( SfxMedium* pMedium )
 {
+    if (!pMedium)
+        return;
+
     bool bHidden = false;
     SFX_ITEMSET_ARG(pMedium->GetItemSet(), pHidItem, SfxBoolItem, SID_HIDDEN, false);
     if (pHidItem)
@@ -1832,7 +1835,7 @@ void SAL_CALL SfxBaseModel::load(   const Sequence< beans::PropertyValue >& seqA
         if (!m_pData->m_pObjectShell->DoLoadExternal(pMedium))
             nError = ERRCODE_IO_GENERAL;
 
-        handleLoadError(nError, pMedium);
+        pMedium = handleLoadError(nError, pMedium);
         setUpdatePickList(pMedium);
         return;
     }
@@ -1920,7 +1923,7 @@ void SAL_CALL SfxBaseModel::load(   const Sequence< beans::PropertyValue >& seqA
 
     m_pData->m_pObjectShell->ResetError();
 
-    handleLoadError(nError, pMedium);
+    pMedium = handleLoadError(nError, pMedium);
     loadCmisProperties();
     setUpdatePickList(pMedium);
 
@@ -2665,11 +2668,13 @@ void SfxBaseModel::loadCmisProperties( )
     }
 }
 
-void SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
+SfxMedium* SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
 {
     if (!nError)
+    {
         // No error condition.
-        return;
+        return pMedium;
+    }
 
     bool bSilent = false;
     SFX_ITEMSET_ARG( pMedium->GetItemSet(), pSilentItem, SfxBoolItem, SID_SILENT, false);
@@ -2692,6 +2697,7 @@ void SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
         // for whatever reason document now has another medium
         OSL_FAIL("Document has rejected the medium?!");
         delete pMedium;
+        pMedium = NULL;
     }
 
     if ( !bWarning )    // #i30711# don't abort loading if it's only a warning
@@ -2701,6 +2707,8 @@ void SfxBaseModel::handleLoadError( sal_uInt32 nError, SfxMedium* pMedium )
             "SfxBaseModel::handleLoadError: 0x" + OUString::number(nError, 16),
             Reference< XInterface >(), nError);
     }
+
+    return pMedium;
 }