[Libreoffice-commits] core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/core/doc/doccomp.cxx     |    1 +
 sw/source/core/doc/docnew.cxx      |    3 +++
 sw/source/core/unocore/unocrsr.cxx |    1 +
 sw/source/core/unocore/unoobj.cxx  |    1 +
 sw/source/uibase/uno/unotxvw.cxx   |    3 +++
 5 files changed, 9 insertions(+)

New commits:
commit 18f16d9d2516b3f7c0edfef05ffe66629c598c36
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Aug 28 14:44:05 2022 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Sun Aug 28 17:22:04 2022 +0200

    cid#1500510 silence Use after free
    
    and
    
    cid#1500471 Use after free
    cid#1500604 Use after free
    cid#1500617 Use after free
    
    Change-Id: Idd86c8c81dd6f0afb6f055fadee778559cb6dba6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138945
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sw/source/core/doc/doccomp.cxx b/sw/source/core/doc/doccomp.cxx
index e29ea7d87f1c..f9b16bb619ad 100644
--- a/sw/source/core/doc/doccomp.cxx
+++ b/sw/source/core/doc/doccomp.cxx
@@ -1739,6 +1739,7 @@ void CompareData::SetRedlinesToDoc( bool bUseDocInfo )
     if( pTmp->GetNext() != m_pInsertRing.get() )
     {
         do {
+            // coverity[deref_arg] - the SwPaM delete moves a new entry into 
GetNext()
             SwPosition& rSttEnd = *pTmp->End(),
                       & rEndStt = *pTmp->GetNext()->Start();
             const SwContentNode* pCNd;
diff --git a/sw/source/core/doc/docnew.cxx b/sw/source/core/doc/docnew.cxx
index ff1659ee1d9d..c7469065143e 100644
--- a/sw/source/core/doc/docnew.cxx
+++ b/sw/source/core/doc/docnew.cxx
@@ -466,7 +466,10 @@ SwDoc::~SwDoc()
         SwPaM* pTmp = mpExtInputRing;
         mpExtInputRing = nullptr;
         while( pTmp->GetNext() != pTmp )
+        {
+            // coverity[deref_arg] - the SwPaM delete moves a new entry into 
GetNext()
             delete pTmp->GetNext();
+        }
         delete pTmp;
     }
 
diff --git a/sw/source/core/unocore/unocrsr.cxx 
b/sw/source/core/unocore/unocrsr.cxx
index ef86e56ff806..c61fa317c598 100644
--- a/sw/source/core/unocore/unocrsr.cxx
+++ b/sw/source/core/unocore/unocrsr.cxx
@@ -44,6 +44,7 @@ SwUnoCursor::~SwUnoCursor()
     while( GetNext() != this )
     {
         Ring* pNxt = GetNextInRing();
+        // coverity[deref_arg] - the delete moves a new entry into GetNext()
         pNxt->MoveTo(nullptr); // remove from chain
         delete pNxt;       // and delete
     }
diff --git a/sw/source/core/unocore/unoobj.cxx 
b/sw/source/core/unocore/unoobj.cxx
index 3c1bfa01008a..7974a7d3cd1b 100644
--- a/sw/source/core/unocore/unoobj.cxx
+++ b/sw/source/core/unocore/unoobj.cxx
@@ -86,6 +86,7 @@ SwUnoInternalPaM::~SwUnoInternalPaM()
 {
     while( GetNext() != this)
     {
+        // coverity[deref_arg] - the delete moves a new entry into GetNext()
         delete GetNext();
     }
 }
diff --git a/sw/source/uibase/uno/unotxvw.cxx b/sw/source/uibase/uno/unotxvw.cxx
index 764479851d18..112e6a934d11 100644
--- a/sw/source/uibase/uno/unotxvw.cxx
+++ b/sw/source/uibase/uno/unotxvw.cxx
@@ -259,7 +259,10 @@ sal_Bool SwXTextView::select(const uno::Any& aInterface)
             rSh.SetSelection(*pPaM);
             // the pPaM has been copied - delete it
             while (pPaM->GetNext() != pPaM)
+            {
+                // coverity[deref_arg] - the SwPaM delete moves a new entry 
into GetNext()
                 delete pPaM->GetNext();
+            }
             delete pPaM;
             return true;
         }