anne/lyx_mirror
1
0
Fork 0
mirror of https://git.lyx.org/repos/lyx.git synced 2024-11-09 18:31:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Avoid using pointer after it has been invalidated

Browse Source 
The pointer macroInset points to a vector element. When another element is inserted in this vector, some reallocation occur and the pointer points to a deleted element.

This does not crash LyX by default, but it is bad enough to make valgrind cry.

See ticket #9804.
This commit is contained in:
Jean-Marc Lasgouttes 2015-11-03 15:20:09 +01:00
parent eb1e85b096
commit 576159156e
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/mathed/MathData.cpp
View File

@ -492,6 +492,8 @@ void MathData::updateMacros(Cursor * cur, MacroContext const & mc,
void MathData::detachMacroParameters(DocIterator * cur, const size_type macroPos)
{
MathMacro * macroInset = operator[](macroPos).nucleus()->asMacro();
// We store this now, because the inset pointer will be invalidated in the scond loop below
size_t const optionals = macroInset->optionals();
// detach all arguments
vector<MathData> detachedArgs;
@ -517,7 +519,7 @@ void MathData::detachMacroParameters(DocIterator * cur, const size_type macroPos
// only [] after the last non-empty argument can be dropped later
size_t lastNonEmptyOptional = 0;
for (size_t l = 0; l < detachedArgs.size() && l < macroInset->optionals(); ++l) {
for (size_t l = 0; l < detachedArgs.size() && l < optionals; ++l) {
if (!detachedArgs[l].empty())
lastNonEmptyOptional = l;
}
@ -525,7 +527,8 @@ void MathData::detachMacroParameters(DocIterator * cur, const size_type macroPos
// optional arguments to be put back?
pos_type p = macroPos + 1;
size_t j = 0;
for (; j < detachedArgs.size() && j < macroInset->optionals(); ++j) {
// WARNING: do not use macroInset below, the insert() call in the lopp will invalidate it!
for (; j < detachedArgs.size() && j < optionals; ++j) {
// another non-empty parameter follows?
bool canDropEmptyOptional = j >= lastNonEmptyOptional;