commit dd93379cdfce856b73d767b9808f8a87f8c8ac29
author Michael Stahl <michael.stahl@allotropia.de> Fri Oct 07 16:21:27 2022 +0200
committer Caolán McNamara <caolanm@redhat.com> Sat Oct 08 17:37:10 2022 +0200
tree c6f50783b966e2b76fc845b617ed4e641dace0a2
parent 040b0d526d7ee99ba60e28388ae01336b9d206ad

tdf#151375 sw: ODF import: delete any layout frames before ...

... converting subtables.

This avoids use-after-free by the frames or a11y code on deleted cells.

For file open, there is no layout at this point, but when inserting a
file the crash happens.

(regression from commit e366c928819c44b5c253c45dca6dae40b71c9808)

Change-Id: Ia2cbe548fd5cdce7ae2479bfc3dc993ebb3ce830
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141080
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit ac8717e861608031e50230015c90e64282a10ad0)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/141062
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

sw/source/core/table/swnewtable.cxx

diff --git a/sw/source/core/table/swnewtable.cxx b/sw/source/core/table/swnewtable.cxx
index 48953db..f3bcc71 100644
--- a/sw/source/core/table/swnewtable.cxx
+++ b/sw/source/core/table/swnewtable.cxx
@@ -2356,6 +2356,8 @@ bool SwTable::CanConvertSubtables() const

void SwTable::ConvertSubtables()
{
    FndBox_ all(nullptr, nullptr);
    all.DelFrames(*this); // tdf#151375 avoid UAF by frames on deleted cells
    for (size_t i = 0; i < GetTabLines().size(); ++i)
    {
        SwTableLine *const pLine(GetTabLines()[i]);
@@ -2371,6 +2373,7 @@ void SwTable::ConvertSubtables()
    }
    GCLines();
    m_bNewModel = true;
    all.MakeFrames(*this);
#if 0
    // note: outline nodes (and ordinary lists) are sorted by MoveNodes() itself
    //       (this could change order inside table of contents, but that's a