commit 4de09a9efdb62cf90ce18662852e556cf7148e14
author Caolán McNamara <caolanm@redhat.com> Wed Dec 10 17:12:08 2014 +0000
committer Caolán McNamara <caolanm@redhat.com> Wed Dec 10 17:13:55 2014 +0000
tree 63801dae81921cd51c3aafac1a82b32029be6bd6
parent a73ece414c6556fc88d1c42b71ce7548ddbf536a

coverity#738980 Use after free

Change-Id: I30657eb609a9d02217238dd37a3f23e05168569c

sw/source/core/layout/ssfrm.cxx

diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index dbda7c1..02f834f 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -457,7 +457,10 @@ void SwLayoutFrm::Destroy()
                // #i28701#
                SwAnchoredObject* pAnchoredObj = (*pFrm->GetDrawObjs())[0];
                if ( pAnchoredObj->ISA(SwFlyFrm) )
                {
                    delete pAnchoredObj;
                    assert(!pFrm->GetDrawObjs() || nCnt > pFrm->GetDrawObjs()->size());
                }
                else
                {
                    SdrObject* pSdrObj = pAnchoredObj->DrawObj();
@@ -469,11 +472,12 @@ void SwLayoutFrm::Destroy()
                    {
                        pContact->DisconnectObjFromLayout( pSdrObj );
                    }
                }
                if ( pFrm->GetDrawObjs() &&
                     nCnt == pFrm->GetDrawObjs()->size() )
                {
                    pFrm->GetDrawObjs()->Remove( *pAnchoredObj );

                    if ( pFrm->GetDrawObjs() &&
                         nCnt == pFrm->GetDrawObjs()->size() )
                    {
                        pFrm->GetDrawObjs()->Remove( *pAnchoredObj );
                    }
                }
            }
            pFrm->Remove();
@@ -488,7 +492,10 @@ void SwLayoutFrm::Destroy()
            // #i28701#
            SwAnchoredObject* pAnchoredObj = (*GetDrawObjs())[0];
            if ( pAnchoredObj->ISA(SwFlyFrm) )
            {
                delete pAnchoredObj;
                assert(!GetDrawObjs() || nCnt > GetDrawObjs()->size());
            }
            else
            {
                SdrObject* pSdrObj = pAnchoredObj->DrawObj();
@@ -500,10 +507,11 @@ void SwLayoutFrm::Destroy()
                {
                    pContact->DisconnectObjFromLayout( pSdrObj );
                }
            }
            if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() )
            {
                GetDrawObjs()->Remove( *pAnchoredObj );

                if ( GetDrawObjs() && nCnt == GetDrawObjs()->size() )
                {
                    GetDrawObjs()->Remove( *pAnchoredObj );
                }
            }
        }
    }