Skip to content

C
core
Kaydet (Commit) 4de09a9e authored tarafından Caolán McNamara's avatar Caolán McNamara
Dosyalara gözat
Seçenekler

coverity#738980 Use after free 

Change-Id: I30657eb609a9d02217238dd37a3f23e05168569c
üst a73ece41
Hide whitespace changes
Inline Side-by-side
Showing with 17 additions and 9 deletions
sw/source/core/layout/ssfrm.cxx
Dosyayı görüntüle @ 4de09a9e
......@@ -457,7 +457,10 @@ void SwLayoutFrm::Destroy()
// #i28701#
SwAnchoredObject* pAnchoredObj = (*pFrm->GetDrawObjs())[0];
if ( pAnchoredObj->ISA(SwFlyFrm) )
{
delete pAnchoredObj;
assert(!pFrm->GetDrawObjs() || nCnt > pFrm->GetDrawObjs()->size());
}
else
{
SdrObject* pSdrObj = pAnchoredObj->DrawObj();
......@@ -469,11 +472,12 @@ void SwLayoutFrm::Destroy()
{
pContact->DisconnectObjFromLayout( pSdrObj );
}
}
if ( pFrm->GetDrawObjs() &&
nCnt == pFrm->GetDrawObjs()->size() )
{
pFrm->GetDrawObjs()->Remove( *pAnchoredObj );
if ( pFrm->GetDrawObjs() &&
nCnt == pFrm->GetDrawObjs()->size() )
{
pFrm->GetDrawObjs()->Remove( *pAnchoredObj );
}
}
}
pFrm->Remove();
......@@ -488,7 +492,10 @@ void SwLayoutFrm::Destroy()
// #i28701#
SwAnchoredObject* pAnchoredObj = (*GetDrawObjs())[0];
if ( pAnchoredObj->ISA(SwFlyFrm) )
{
delete pAnchoredObj;
assert(!GetDrawObjs() || nCnt > GetDrawObjs()->size());
}
else
{
SdrObject* pSdrObj = pAnchoredObj->DrawObj();
......@@ -500,10 +507,11 @@ void SwLayoutFrm::Destroy()
{
pContact->DisconnectObjFromLayout( pSdrObj );
}
}
if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() )
{
GetDrawObjs()->Remove( *pAnchoredObj );
if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() )
{
GetDrawObjs()->Remove( *pAnchoredObj );
}
}
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment