commit 60aac84fc83ca6d527d06cf4ce031d7ef5ffee48
author Caolán McNamara <caolanm@redhat.com> Thu Mar 16 21:22:36 2017 +0000
committer Caolán McNamara <caolanm@redhat.com> Fri Apr 07 09:01:53 2017 +0000
tree c361002dccdc0c577c0be94b4bc94ffd311f0e9e
parent fef765d68d090bb439f58347afc930f48567673e

ofz#888: use after free

Change-Id: I6d3f9108b02149165b020fc9c6677880456a1ef4
Reviewed-on: https://gerrit.libreoffice.org/35298
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

filter/source/msfilter/svdfppt.cxx

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index dfd8148..92d9025 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2934,7 +2934,18 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                            // obsolete here, too.
                            pRet->getSdrPageProperties().ClearItem();
                            pRet->getSdrPageProperties().PutItemSet(rSlidePersist.pBObj->GetMergedItemSet());
                            SdrObject::Free( rSlidePersist.pBObj );
                            if (rSlidePersist.pSolverContainer)
                            {
                                for (SvxMSDffConnectorRule* pPtr : rSlidePersist.pSolverContainer->aCList)
                                {
                                    // check connections to the group object
                                    if (pPtr->pAObj == rSlidePersist.pBObj)
                                        pPtr->pAObj = nullptr;
                                    if (pPtr->pBObj == rSlidePersist.pBObj)
                                        pPtr->pBObj = nullptr;
                                }
                            }
                            SdrObject::Free(rSlidePersist.pBObj);
                        }
                    }
                }