• Michael Stahl's avatar
    tdf#112311 oox: fix UAF of std::shared_ptr · 88c84e71
    Michael Stahl yazdı
    OOXMLFastContextHandlerShape::sendShape() deletes the parent context's
    ShapeTypeContext::mrTypeModel.
    
    It looks like the sendShape() can't be delayed because writerfilter
    wants to import the v:textbox content into a text frame.
    
    Keep the shape alive until the end of the containing context.
    
    Not sure if it's going to process the v:fill element properly,
    but at lest valgrind is happy.
    
    (probably regression from CWS writerfilter32bugfixes01)
    
    Change-Id: Ifeab84751a1b20b2f272c4dd74b7097deb5eece0
    88c84e71
Adı
Son kayıt (commit)
Son güncelleme
..
vmldrawing.hxx Loading commit data...
vmldrawingfragment.hxx Loading commit data...
vmlformatting.hxx Loading commit data...
vmlinputstream.hxx Loading commit data...
vmlshape.hxx Loading commit data...
vmlshapecontainer.hxx Loading commit data...
vmlshapecontext.hxx Loading commit data...
vmltextbox.hxx Loading commit data...
vmltextboxcontext.hxx Loading commit data...