writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
New commits: commit 75fce8a65679a9383b139f3f9866a43ac7bda803 Author: Tor Lillqvist <tlillqv...@suse.com> Date: Mon Mar 12 15:19:14 2012 +0200 Fix crash with document from bnc#693238 Signed-off-by: Cedric Bosdonnat <cbosdon...@suse.com> diff --git a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx index 52dd4b7..5353d84 100644 --- a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx +++ b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx @@ -424,10 +424,15 @@ OOXMLPropertySetImpl::~OOXMLPropertySetImpl() void OOXMLPropertySetImpl::resolve(Properties & rHandler) { - OOXMLProperties_t::iterator aIt = begin(); - while (aIt != end()) + size_t nIt = 0; + + // The pProp->resolve(rHandler) call below can cause elements to + // be appended to mProperties. I don't think it can cause elements + // to be deleted. But let's check with < here just to be safe that + // the indexing below works. + while (nIt < mProperties.size()) { - OOXMLProperty::Pointer_t pProp = *aIt; + OOXMLProperty::Pointer_t pProp = mProperties[nIt]; if (pProp.get() != NULL) pProp->resolve(rHandler); @@ -440,7 +445,7 @@ void OOXMLPropertySetImpl::resolve(Properties & rHandler) } #endif - ++aIt; + ++nIt; } } _______________________________________________ Libreoffice-commits mailing list Libreoffice-commits@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits