• Michael Stahl's avatar
    tdf#112311 oox: fix UAF of std::shared_ptr · 88c84e71
    Michael Stahl yazdı
    OOXMLFastContextHandlerShape::sendShape() deletes the parent context's
    ShapeTypeContext::mrTypeModel.
    
    It looks like the sendShape() can't be delayed because writerfilter
    wants to import the v:textbox content into a text frame.
    
    Keep the shape alive until the end of the containing context.
    
    Not sure if it's going to process the v:fill element properly,
    but at lest valgrind is happy.
    
    (probably regression from CWS writerfilter32bugfixes01)
    
    Change-Id: Ifeab84751a1b20b2f272c4dd74b7097deb5eece0
    88c84e71
vmlshapecontainer.hxx 5.11 KB