• Michael Stahl's avatar
    tdf#112311 oox: fix UAF of std::shared_ptr · 88c84e71
    Michael Stahl yazdı
    OOXMLFastContextHandlerShape::sendShape() deletes the parent context's
    ShapeTypeContext::mrTypeModel.
    
    It looks like the sendShape() can't be delayed because writerfilter
    wants to import the v:textbox content into a text frame.
    
    Keep the shape alive until the end of the containing context.
    
    Not sure if it's going to process the v:fill element properly,
    but at lest valgrind is happy.
    
    (probably regression from CWS writerfilter32bugfixes01)
    
    Change-Id: Ifeab84751a1b20b2f272c4dd74b7097deb5eece0
    88c84e71
Adı
Son kayıt (commit)
Son güncelleme
..
inc Loading commit data...
qa Loading commit data...
source Loading commit data...
util Loading commit data...
CppunitTest_oox_tokenmap.mk Loading commit data...
CppunitTest_oox_vba_compression.mk Loading commit data...
CppunitTest_oox_vba_encryption.mk Loading commit data...
CustomTarget_generated.mk Loading commit data...
Library_oox.mk Loading commit data...
Makefile Loading commit data...
Module_oox.mk Loading commit data...
Package_customshapes.mk Loading commit data...
Package_generated.mk Loading commit data...
README Loading commit data...