svx/source/tbxctrls/PaletteManager.cxx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
New commits: commit 36b25a83fe0b6b0ae0f179bedfc207375633ed19 Author: Matthew J. Francis <mjay.fran...@gmail.com> Date: Sun Oct 19 16:24:55 2014 +0800 fdo#85185 Copy OUString argument to avoid a use after free The original OUString is destroyed along with its containing object part way through the call to PaletteManager::PopupColorPicker(), so a copy must be taken Change-Id: I8417ff23a17003e80a4f65e0cf1ad2a8dda5386c Reviewed-on: https://gerrit.libreoffice.org/12031 Reviewed-by: Noel Grandin <noelgran...@gmail.com> Tested-by: Noel Grandin <noelgran...@gmail.com> diff --git a/svx/source/tbxctrls/PaletteManager.cxx b/svx/source/tbxctrls/PaletteManager.cxx index ca4c014..c561a5e 100644 --- a/svx/source/tbxctrls/PaletteManager.cxx +++ b/svx/source/tbxctrls/PaletteManager.cxx @@ -197,6 +197,8 @@ void PaletteManager::SetBtnUpdater(svx::ToolboxButtonColorUpdater* pBtnUpdater) void PaletteManager::PopupColorPicker(const OUString& aCommand) { + // The calling object goes away during aColorDlg.Execute(), so we must copy this + OUString aCommandCopy = aCommand; SvColorDialog aColorDlg( 0 ); aColorDlg.SetColor ( mLastColor ); aColorDlg.SetMode( svtools::ColorPickerMode_MODIFY ); @@ -206,7 +208,7 @@ void PaletteManager::PopupColorPicker(const OUString& aCommand) mpBtnUpdater->Update( aColorDlg.GetColor() ); mLastColor = aColorDlg.GetColor(); AddRecentColor( mLastColor ); - DispatchColorCommand(aCommand, mLastColor); + DispatchColorCommand(aCommandCopy, mLastColor); } } _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits