[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - sw/qa sw/source

[Caolán McNamara (via logerrit)]

 sw/qa/extras/layout/data/forcepoint94.html |binary
 sw/qa/extras/layout/layout.cxx             |    6 ++++++
 sw/source/core/layout/ftnfrm.cxx           |    3 +++
 3 files changed, 9 insertions(+)

New commits:
commit 3b6ea366796f7f7e04fb60b9394c91e4790b5c72
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Mar 27 20:51:48 2022 +0100
Commit:     Michael Stahl <michael.st...@allotropia.de>
CommitDate: Thu Mar 31 11:21:07 2022 +0200

    forcepoint#94 fix crash on layout of specific html
    
    Change-Id: I1874a431d5af9d56248a695e08a2f95b5292ba9a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132179
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>

diff --git a/sw/qa/extras/layout/data/forcepoint94.html 
b/sw/qa/extras/layout/data/forcepoint94.html
new file mode 100644
index 000000000000..8be788f8e4e5
Binary files /dev/null and b/sw/qa/extras/layout/data/forcepoint94.html differ
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index cd8307f1caa6..72db33e49b7c 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -2508,6 +2508,12 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint92)
     createSwDoc(DATA_DIRECTORY, "forcepoint92.doc");
 }
 
+//just care it doesn't crash/assert
+CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint94)
+{
+    createSwWebDoc(DATA_DIRECTORY, "forcepoint94.html");
+}
+
 CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf118058)
 {
     SwDoc* pDoc = createSwDoc(DATA_DIRECTORY, "tdf118058.fodt");
diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index c41b315ad685..ba0cde71e7ea 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -2860,6 +2860,9 @@ bool SwContentFrame::MoveFootnoteCntFwd( bool bMakePage, 
SwFootnoteBossFrame *pO
                             OSL_ENSURE( pTmp->IsTabFrame(), "GetNextSctLeaf: 
Wrong Type" );
                             pTmpNxt = static_cast<SwTabFrame*>(pTmp);
                         }
+                        // we will dereference pNewUp in the following 
MoveSubTree call
+                        // so it certainly should not be deleted before that
+                        SwFrameDeleteGuard aDeleteGuard(pNewUp);
                         pTmpNxt->MoveSubTree( pTmpFootnote, pNewUp->GetNext() 
);
                     }
                 }