sw/source/core/table/swnewtable.cxx | 3 +++
1 file changed, 3 insertions(+)
New commits:
commit dd93379cdfce856b73d767b9808f8a87f8c8ac29
Author: Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Fri Oct 7 16:21:27 2022 +0200
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Oct 8 17:37:10 2022 +0200
tdf#151375 sw: ODF import: delete any layout frames before ...
... converting subtables.
This avoids use-after-free by the frames or a11y code on deleted cells.
For file open, there is no layout at this point, but when inserting a
file the crash happens.
(regression from commit e366c928819c44b5c253c45dca6dae40b71c9808)
Change-Id: Ia2cbe548fd5cdce7ae2479bfc3dc993ebb3ce830
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141080
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit ac8717e861608031e50230015c90e64282a10ad0)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141062
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sw/source/core/table/swnewtable.cxx
b/sw/source/core/table/swnewtable.cxx
index 48953db7c75c..f3bcc71f48f9 100644
--- a/sw/source/core/table/swnewtable.cxx
+++ b/sw/source/core/table/swnewtable.cxx
@@ -2356,6 +2356,8 @@ bool SwTable::CanConvertSubtables() const
void SwTable::ConvertSubtables()
{
+ FndBox_ all(nullptr, nullptr);
+ all.DelFrames(*this); // tdf#151375 avoid UAF by frames on deleted cells
for (size_t i = 0; i < GetTabLines().size(); ++i)
{
SwTableLine *const pLine(GetTabLines()[i]);
@@ -2371,6 +2373,7 @@ void SwTable::ConvertSubtables()
}
GCLines();
m_bNewModel = true;
+ all.MakeFrames(*this);
#if 0
// note: outline nodes (and ordinary lists) are sorted by MoveNodes()
itself
// (this could change order inside table of contents, but that's a
