commit 0cd000bb83719982c1fd2265ea040c82af5bf98e
author Daniel Arato (NISZ) <arato.daniel@nisz.hu> Mon Apr 26 15:04:17 2021 +0200
committer László Németh <nemeth@numbertext.org> Mon May 10 15:41:28 2021 +0200
tree 8a4b76358e29c56d0b542556064d541dbbd8c2b4
parent 2436ed69a9dec1432117e894cba8ed693960f581

tdf#141613 sw: avoid possible crash when undoing header creation

Move the ClearRedo() call to the very end of the undo process in order to avoid heap use after free.

We still need to call ClearRedo() because there's no mechanism in place to Redo a header/footer change.

Regression from commit 65e52cb61d74b0c71b45b63b2da131bc6b621104
"tdf#141613 sw: fix crash at header/footer undo".

Change-Id: Ibd4604379c9791e85aef3d4dc6c29c9e3ecd5a28
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/115275
Tested-by: László Németh <nemeth@numbertext.org>
Reviewed-by: László Németh <nemeth@numbertext.org>

sw/source/core/doc/docdesc.cxx

diff --git a/sw/source/core/doc/docdesc.cxx b/sw/source/core/doc/docdesc.cxx
index 4f38197..fb7211d 100644
--- a/sw/source/core/doc/docdesc.cxx
+++ b/sw/source/core/doc/docdesc.cxx
@@ -503,9 +503,6 @@ void SwDoc::ChgPageDesc( size_t i, const SwPageDesc &rChged )
                lDelHFFormat(&rDescLeftFooterFormat, rDescLeftFooterFormat.GetFooterFormat());
            else if (rDescFirstLeftFooterFormat.GetFooterFormat() && rDescFirstLeftFooterFormat != rChgedFirstLeftFooterFormat)
                lDelHFFormat(&rDescFirstLeftFooterFormat, rDescFirstLeftFooterFormat.GetFooterFormat());

            // FIXME: Disable redoing this change until we figure out how
            GetIDocumentUndoRedo().ClearRedo();
        }
    }
    ::sw::UndoGuard const undoGuard(GetIDocumentUndoRedo());

sw/source/uibase/shells/basesh.cxx

diff --git a/sw/source/uibase/shells/basesh.cxx b/sw/source/uibase/shells/basesh.cxx
index 78e37c0..d8b4c321 100644
--- a/sw/source/uibase/shells/basesh.cxx
+++ b/sw/source/uibase/shells/basesh.cxx
@@ -559,6 +559,12 @@ void SwBaseShell::ExecUndo(SfxRequest &rReq)
                rWrtShell.Do( SwWrtShell::UNDO, nCnt );
                for (SwViewShell& rShell : rWrtShell.GetRingContainer())
                    rShell.UnlockPaint();

                // tdf#141613 FIXME: Disable redoing header/footer changes for now.
                // The proper solution would be to write a SwUndoHeaderFooter class
                // to represent the addition of a header or footer to the current page.
                if (nUndoId == SwUndoId::HEADER_FOOTER)
                    rUndoRedo.ClearRedo();
            }
            break;