sw/source/core/layout/colfrm.cxx |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

New commits:
commit 08417f7928ad28578615cb896b61f30574d062e8
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Tue Jan 2 21:38:13 2024 +0000
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Wed Jan 3 22:10:33 2024 +0100

    cid#1545317 silence/assert Use after free
    
    reassume coverity this shouldn't happen, and assert to test doc
    corpus
    
    Change-Id: I67182328410aa398d28591d0cc7475e37fd1f9a9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161570
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sw/source/core/layout/colfrm.cxx b/sw/source/core/layout/colfrm.cxx
index 872bdc44aef1..96351c020b3a 100644
--- a/sw/source/core/layout/colfrm.cxx
+++ b/sw/source/core/layout/colfrm.cxx
@@ -81,7 +81,7 @@ void SwColumnFrame::dumpAsXml(xmlTextWriterPtr writer) const
     (void)xmlTextWriterEndElement(writer);
 }
 
-static void lcl_RemoveColumns( SwLayoutFrame *pCont, sal_uInt16 nCnt )
+static void lcl_RemoveColumns(SwLayoutFrame *pCont, sal_uInt16 nCnt, const 
SwFrame *pSave)
 {
     OSL_ENSURE( pCont && pCont->Lower() && pCont->Lower()->IsColumnFrame(),
             "no columns to remove." );
@@ -98,6 +98,7 @@ static void lcl_RemoveColumns( SwLayoutFrame *pCont, 
sal_uInt16 nCnt )
     {
         SwColumnFrame *pTmp = static_cast<SwColumnFrame*>(pColumn->GetPrev());
         pColumn->Cut();
+        assert(pSave != pColumn && "we will deref pSave later, so shouldn't be 
deleted here"); (void)pSave;
         SwFrame::DestroyFrame(pColumn); //format is going to be destroyed in 
the DTor if needed.
         pColumn = pTmp;
     }
@@ -247,7 +248,7 @@ void SwLayoutFrame::ChgColumns( const SwFormatCol &rOld, 
const SwFormatCol &rNew
         //If columns exist, they get deleted if a column count of 0 or 1 is 
requested.
         if ( nNewNum == 1 && !bAtEnd )
         {
-            ::lcl_RemoveColumns( this, nOldNum );
+            ::lcl_RemoveColumns( this, nOldNum, pSave );
             if ( IsBodyFrame() )
                 SetFrameFormat( pDoc->GetDfltFrameFormat() );
             else
@@ -267,7 +268,7 @@ void SwLayoutFrame::ChgColumns( const SwFormatCol &rOld, 
const SwFormatCol &rNew
         }
         if ( nOldNum > nNewNum )
         {
-            ::lcl_RemoveColumns( this, nOldNum - nNewNum );
+            ::lcl_RemoveColumns( this, nOldNum - nNewNum, pSave );
             bAdjustAttributes = true;
         }
         else if( nOldNum < nNewNum )

Reply via email to