[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - starmath/source
starmath/source/mathml/iterator.cxx |6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
New commits:
commit 4dcc03681395a894adb0179045fc4be2339a1f10
Author: Michael Stahl
AuthorDate: Sun May 22 14:50:55 2022 +0200
Commit: Caolán McNamara
CommitDate: Tue May 24 09:57:54 2022 +0200
starmath: fix real use-after-free detected by GCC 12
In file included from starmath/inc/mathml/iterator.hxx:12,
from starmath/source/mathml/iterator.cxx:10:
In member function ‘SmMlElement* SmMlElement::getParentElement()’,
inlined from ‘void mathml::SmMlIteratorBottomToTop(SmMlElement*,
runType, void*) [with runType = void (*)(SmMlElement*, void*)]’ at
starmath/inc/mathml/iterator.hxx:43:39,
inlined from ‘void mathml::SmMlIteratorFree(SmMlElement*)’ at
starmath/source/mathml/iterator.cxx:57:28:
starmath/inc/mathml/element.hxx:263:46: error: pointer ‘pCurrent’ used
after ‘void operator delete(void*, std::size_t)’ [-Werror=use-after-free]
263 | SmMlElement* getParentElement() { return m_aParentElement; };
| ^~~~
In function ‘void mathml::deleteElement(SmMlElement*, void*)’,
inlined from ‘void mathml::deleteElement(SmMlElement*, void*)’ at
starmath/source/mathml/iterator.cxx:19:20,
inlined from ‘void mathml::SmMlIteratorBottomToTop(SmMlElement*,
runType, void*) [with runType = void (*)(SmMlElement*, void*)]’ at
starmath/inc/mathml/iterator.hxx:65:21,
inlined from ‘void mathml::SmMlIteratorFree(SmMlElement*)’ at
starmath/source/mathml/iterator.cxx:57:28:
starmath/source/mathml/iterator.cxx:19:77: note: call to ‘void operator
delete(void*, std::size_t)’ here
19 | static inline void deleteElement(SmMlElement* aSmMlElement, void*)
{ delete aSmMlElement; }
|
^~~~
Change-Id: I09acfe3f7e90bd7f919cfba161f72bdd7a8da70a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134742
Tested-by: Jenkins
Reviewed-by: Michael Stahl
(cherry picked from commit 32c43ee75c094ffe3c34f7a713aa252479515ad0)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134775
Reviewed-by: Caolán McNamara
diff --git a/starmath/source/mathml/iterator.cxx
b/starmath/source/mathml/iterator.cxx
index 481ff799689c..489cbe8ebc05 100644
--- a/starmath/source/mathml/iterator.cxx
+++ b/starmath/source/mathml/iterator.cxx
@@ -56,7 +56,11 @@ void SmMlIteratorFree(SmMlElement* pMlElementTree)
{
if (pMlElementTree == nullptr)
return;
-SmMlIteratorBottomToTop(pMlElementTree, deleteElement, nullptr);
+for (size_t i = 0; i < pMlElementTree->getSubElementsCount(); ++i)
+{
+SmMlIteratorFree(pMlElementTree->getSubElement(i));
+}
+deleteElement(pMlElementTree, nullptr);
}
SmMlElement* SmMlIteratorCopy(SmMlElement* pMlElementTree)
[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - starmath/source
starmath/source/edit.cxx |4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
New commits:
commit db439064030a8a90171d03c8250398b063499830
Author: Caolán McNamara
AuthorDate: Fri May 6 14:41:15 2022 +0100
Commit: Adolfo Jayme Barrientos
CommitDate: Sun May 8 10:07:30 2022 +0200
tdf#148962 starmath's UnicodeNotationToggle (alt+x) getting called twice
Change-Id: Ib150e4825c547c19a30c7b66d3f33904b814a917
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133865
Tested-by: Jenkins
Reviewed-by: Adolfo Jayme Barrientos
diff --git a/starmath/source/edit.cxx b/starmath/source/edit.cxx
index e8e79a24e12c..939fe311138b 100644
--- a/starmath/source/edit.cxx
+++ b/starmath/source/edit.cxx
@@ -342,7 +342,9 @@ bool SmEditTextWindow::KeyInput(const KeyEvent& rKEvt)
if (!bConsumed)
{
SmViewShell *pView = mrEditWindow.GetView();
-if ( pView && !pView->KeyInput(rKEvt) )
+if (pView)
+bConsumed = pView->KeyInput(rKEvt);
+if (pView && !bConsumed)
{
// F1 (help) leads to the destruction of this
Flush();
[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - starmath/source
starmath/source/view.cxx | 21 -
1 file changed, 4 insertions(+), 17 deletions(-)
New commits:
commit aa705140c1891599202f918018ef54a6260174ce
Author: Mike Kaganski
AuthorDate: Fri Mar 11 15:19:41 2022 +0300
Commit: Xisco Fauli
CommitDate: Mon Mar 14 14:23:42 2022 +0100
Related: tdf#128610 Avoid use-after-free
Creating SvMemoryStream from string makes it non-owning, i.e. pointing
to the string's memory. So the string must outlive the stream.
Since commit 64bc8b45b5c23efc5fe57585a69aa4263aaf4e83
Date Wed Jul 08 12:31:43 2015 +
i#107734 Support for Math Input Panel in Windows 7
Was only working by chance, when destructor didn't clean the memory
(e.g., in optimized release builds) and the released memory hasn't
been reused yet.
Change-Id: I2e0c195de7bd2aff2889a94ef0f2eb084411933f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131373
Tested-by: Mike Kaganski
Reviewed-by: Mike Kaganski
(cherry picked from commit c964700d16d99d1569373a1eb9a1352fb3512915)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131474
Tested-by: Jenkins
Reviewed-by: Xisco Fauli
diff --git a/starmath/source/view.cxx b/starmath/source/view.cxx
index 5bc143ab394b..62e8b01d5348 100644
--- a/starmath/source/view.cxx
+++ b/starmath/source/view.cxx
@@ -1778,31 +1778,18 @@ void SmViewShell::Execute(SfxRequest& rReq)
SfxFilter::GetFilterByName(MATHML_XML);
aClipboardMedium.SetFilter(pMathFilter);
-std::unique_ptr pStrm;
// The text to be imported might asserts encoding
like 'encoding="utf-8"' but FORMAT_STRING is UTF-16.
// Force encoding to UTF-16, if encoding exists.
-bool bForceUTF16 = false;
sal_Int32 nPosL = aString.indexOf("encoding=\"");
-sal_Int32 nPosU = -1;
if ( nPosL >= 0 && nPosL +10 < aString.getLength()
)
{
nPosL += 10;
-nPosU = aString.indexOf( '"',nPosL);
+sal_Int32 nPosU = aString.indexOf( '"',nPosL);
if (nPosU > nPosL)
-{
-bForceUTF16 = true;
-}
+aString = aString.replaceAt(nPosL, nPosU -
nPosL, u"UTF-16");
}
-if ( bForceUTF16 )
-{
-OUString aNewString = aString.replaceAt(
nPosL, nPosU-nPosL, u"UTF-16");
-pStrm.reset(new SvMemoryStream(
const_cast(aNewString.getStr()), aNewString.getLength() *
sizeof(sal_Unicode), StreamMode::READ));
-}
-else
-{
-pStrm.reset(new SvMemoryStream(
const_cast(aString.getStr()), aString.getLength() *
sizeof(sal_Unicode), StreamMode::READ));
-}
-uno::Reference xStrm2( new
::utl::OInputStreamWrapper(*pStrm) );
+SvMemoryStream aStrm( const_cast(aString.getStr()), aString.getLength() * sizeof(sal_Unicode),
StreamMode::READ);
+uno::Reference xStrm2( new
::utl::OInputStreamWrapper(aStrm) );
aClipboardMedium.setStreamToLoadFrom(xStrm2, true
/*bIsReadOnly*/);
InsertFrom(aClipboardMedium);
GetDoc()->UpdateText();
[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - starmath/source
starmath/source/dialog.cxx |3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) New commits: commit f3f5341d24a34e8e97c5c451a9c86f8a306e48f8 Author: Caolán McNamara AuthorDate: Fri Feb 25 21:43:04 2022 + Commit: Michael Stahl CommitDate: Mon Feb 28 11:44:23 2022 +0100 cid#1500654 Using a moved object Change-Id: Ia4b74cdeeae7f0c03e7e050be30714f948c67106 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130549 Tested-by: Jenkins Reviewed-by: Michael Stahl diff --git a/starmath/source/dialog.cxx b/starmath/source/dialog.cxx index 0857f2456db6..b7d875f94082 100644 --- a/starmath/source/dialog.cxx +++ b/starmath/source/dialog.cxx @@ -1349,8 +1349,9 @@ bool SmSymbolDialog::SelectSymbolSet(const OUString ) return pSym1->GetCharacter() < pSym2->GetCharacter(); } ); +const bool bEmptySymbolSet = aSymbolSet.empty(); m_xSymbolSetDisplay->SetSymbolSet( std::move(aSymbolSet) ); -if (!aSymbolSet.empty()) +if (!bEmptySymbolSet) SelectSymbol(0); bRet = true;
