[Libreoffice-commits] core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/core/text/itrform2.cxx |    9 +++++++++
 1 file changed, 9 insertions(+)

New commits:
commit 46e40f2f7c742ffe01833551bb2843d156716be0
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue May 2 11:59:52 2023 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Tue May 2 16:17:49 2023 +0200

    ofz#58550 Direct-leak in writer layout
    
    Change-Id: Id29138896a8da7a6badbeecfb0df24171c51f145
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151264
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sw/source/core/text/itrform2.cxx b/sw/source/core/text/itrform2.cxx
index f754e13c63a4..1eae79dc4125 100644
--- a/sw/source/core/text/itrform2.cxx
+++ b/sw/source/core/text/itrform2.cxx
@@ -540,6 +540,15 @@ void SwTextFormatter::BuildPortions( SwTextFormatInfo 
&rInf )
                     SwKernPortion* pKrn =
                         new SwKernPortion( *rInf.GetLast(), nLstHeight,
                                            pLast->InFieldGrp() && 
pPor->InFieldGrp() );
+
+                    // ofz#58550 Direct-leak, pKrn adds itself as the 
NextPortion
+                    // of rInf.GetLast(), but may use CopyLinePortion to add a 
copy
+                    // of itself, which will then be left dangling with the 
following
+                    // SetNextPortion(nullptr)
+                    SwLinePortion *pNext = rInf.GetLast()->GetNextPortion();
+                    if (pNext != pKrn)
+                        delete pNext;
+
                     rInf.GetLast()->SetNextPortion( nullptr );
                     InsertPortion( rInf, pKrn );
                 }