diff options
author | Tor Lillqvist <tlillqvist@suse.com> | 2012-03-12 15:19:14 +0200 |
---|---|---|
committer | Petr Mladek <pmladek@suse.cz> | 2012-03-13 10:05:20 +0100 |
commit | c88d73bc050357eb4bb26f20e1599bd451bfca4b (patch) | |
tree | ba5f6d4d8bfd353594a15fa877a91fde2df5c341 | |
parent | 636abb692afb818b797794ff14384aefe16a7ae2 (diff) |
Fix crash with document from bnc#693238libreoffice-3-4
Signed-off-by: Cedric Bosdonnat <cbosdonnat@suse.com>
-rw-r--r-- | writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx index 488b77cc6..61fc0277e 100644 --- a/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx +++ b/writerfilter/source/ooxml/OOXMLPropertySetImpl.cxx @@ -424,10 +424,15 @@ OOXMLPropertySetImpl::~OOXMLPropertySetImpl() void OOXMLPropertySetImpl::resolve(Properties & rHandler) { - OOXMLProperties_t::iterator aIt = begin(); - while (aIt != end()) + size_t nIt = 0; + + // The pProp->resolve(rHandler) call below can cause elements to + // be appended to mProperties. I don't think it can cause elements + // to be deleted. But let's check with < here just to be safe that + // the indexing below works. + while (nIt < mProperties.size()) { - OOXMLProperty::Pointer_t pProp = *aIt; + OOXMLProperty::Pointer_t pProp = mProperties[nIt]; if (pProp.get() != NULL) pProp->resolve(rHandler); @@ -440,7 +445,7 @@ void OOXMLPropertySetImpl::resolve(Properties & rHandler) } #endif - ++aIt; + ++nIt; } } |