{"push_id":3747279714,"size":1,"distinct_size":1,"ref":"refs/heads/distro/lhm/libreoffice-6-1+backports","head":"925ce62d9e86cf7c3fb2917c69c75f7c726f8089","before":"6da245521e93d6ea24dee1a4ac0d4fb4d94c0dcf","commits":[{"sha":"925ce62d9e86cf7c3fb2917c69c75f7c726f8089","author":{"name":"Michael Stahl","email":"b98f7cd6e58113409af158a5176667f0fc282cf0@cib.de"},"message":"tdf#125741 sw: avoid joining table frames in SwFrame::PrepareCursor()\n\nThe problem is that the PrepareCursor() is called on a frame in a nested\ntable, and the inner table is joined by its predecessor...\n\n0x6120010a3348 is located 136 bytes inside of 296-byte region [0x6120010a32c0,0x6120010a33e8)\nfreed by thread T0 here:\n    #1 SwTabFrame::~SwTabFrame() sw/source/core/layout/tabfrm.cxx:143:1\n    #2 SwFrame::DestroyFrame(SwFrame*) sw/source/core/layout/ssfrm.cxx:389:9\n    #3 SwTabFrame::Join() sw/source/core/layout/tabfrm.cxx:1379:9\n    #4 SwTabFrame::MakeAll(OutputDevice*) sw/source/core/layout/tabfrm.cxx:1870:9\n    #5 SwFrame::PrepareMake(OutputDevice*) sw/source/core/layout/calcmove.cxx:364:5\n    #6 SwFrame::Calc(OutputDevice*) const sw/source/core/layout/trvlfrm.cxx:1791:37\n    #7 lcl_InnerCalcLayout(SwFrame*, long, bool) sw/source/core/layout/tabfrm.cxx:1584:21\n    #8 lcl_InnerCalcLayout(SwFrame*, long, bool) sw/source/core/layout/tabfrm.cxx:1586:25\n    #9 lcl_InnerCalcLayout(SwFrame*, long, bool) sw/source/core/layout/tabfrm.cxx:1586:25\n    #10 lcl_RecalcRow(SwRowFrame*, long) sw/source/core/layout/tabfrm.cxx:1621:16\n    #11 SwTabFrame::MakeAll(OutputDevice*) sw/source/core/layout/tabfrm.cxx:2410:21\n    #12 SwFrame::PrepareMake(OutputDevice*) sw/source/core/layout/calcmove.cxx:364:5\n    #13 SwFrame::Calc(OutputDevice*) const sw/source/core/layout/trvlfrm.cxx:1791:37\n    #14 SwFrame::PrepareCursor() sw/source/core/layout/calcmove.cxx:481:5\n    #15 SwFrame::PrepareCursor() sw/source/core/layout/calcmove.cxx:397:21\n    #16 SwFrame::PrepareCursor() sw/source/core/layout/calcmove.cxx:397:21\n    #17 SwFrame::PrepareCursor() sw/source/core/layout/calcmove.cxx:397:21\n    #18 SwFrame::PrepareCursor() sw/source/core/layout/calcmove.cxx:397:21\n    #19 SwFrame::PrepareCursor() sw/source/core/layout/calcmove.cxx:397:21\n    #20 SwFrame::PrepareCursor() sw/source/core/layout/calcmove.cxx:397:21\n    #21 SwCursorShell::UpdateCursor(unsigned short, bool) sw/source/core/crsr/crsrsh.cxx:1851:25\n    #22 SwCursorShell::EndAction(bool, bool) sw/source/core/crsr/crsrsh.cxx:269:5\n    #23 SwCursorShell::EndCursorMove(bool) sw/source/core/crsr/crsrsh.cxx:305:5\n    #24 SwLayIdle::SwLayIdle(SwRootFrame*, SwViewShellImp*) sw/source/core/layout/layact.cxx:2238:35\n\nAfter the paste, the formatting goes only until\nSwLayAction::IsShortCut() exits early because the previous visible page\nis formatted - but the cursor position was moved downward and is no\nlonger visible, so we get an idle-layout later where UpdateCursor()\ntriggers more formatting...\n\nSo prevent the use-after-free with some more guards, which isn't the\nmost elegant solution, but with 4 levels of nested tables elegant\nsolutions are in short supply...\n\n(apparently a regression from the SwFlowFrame::MoveBwd() change in\n 18765b9fa739337d2d891513f6e2fb7c3ce23b50)\n\nChange-Id: Ie166d3b58fe84c3e4808b52202802a471fa81026\nReviewed-on: https://gerrit.libreoffice.org/74518\nTested-by: Jenkins\nReviewed-by: Michael Stahl <Michael.Stahl@cib.de>\n(cherry picked from commit a23661bfe02d81bd9c1f1e04c59384d19cc61726)\nReviewed-on: https://gerrit.libreoffice.org/74632\nReviewed-by: Caolán McNamara <caolanm@redhat.com>\nTested-by: Caolán McNamara <caolanm@redhat.com>\n(cherry picked from commit 1914932e2fd0598508823464765f3b1ac31236a1)\nReviewed-on: https://gerrit.libreoffice.org/74647\nTested-by: Michael Stahl <Michael.Stahl@cib.de>","distinct":true,"url":"https://api.github.com/repos/LibreOffice/core/commits/925ce62d9e86cf7c3fb2917c69c75f7c726f8089"}]}
{"actor":{"display_login":"tdf-gerrit"}}