anne/lyx_mirror
1
0
Fork 0
mirror of https://git.lyx.org/repos/lyx.git synced 2024-12-22 13:18:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Avoid memory reuse problems with inset-dissolve

Browse Source 
If
 1. the inset is deleted before pasting its contents in the outer text, and
 2. the inset contents begins with an inset, and
 3. the clone of this inner inset is allocated at the memory location just
    made free,
then bad things can happen.

To avoid this, we delete the inset only after its contents has been pasted.

Fixes bug #10667.
This commit is contained in:
Jean-Marc Lasgouttes 2017-06-15 11:37:40 +02:00
parent 939962869b
commit 9c92494e1a
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/Text.cpp
View File

@ -1745,20 +1745,24 @@ bool Text::dissolveInset(Cursor & cur)
cur.recordUndoInset(); cur.recordUndoInset();
cur.setMark(false); cur.setMark(false);
cur.selHandle(false); cur.selHandle(false);
// save position // save position inside inset
pos_type spos = cur.pos(); pos_type spos = cur.pos();
pit_type spit = cur.pit(); pit_type spit = cur.pit();
ParagraphList plist; ParagraphList plist;
if (cur.lastpit() != 0 || cur.lastpos() != 0) if (cur.lastpit() != 0 || cur.lastpos() != 0)
plist = paragraphs(); plist = paragraphs();
cur.popBackward(); cur.popBackward();
// store cursor offset // update cursor offset
if (spit == 0) if (spit == 0)
spos += cur.pos(); spos += cur.pos();
spit += cur.pit(); spit += cur.pit();
Buffer & b = *cur.buffer(); // remember position outside inset to delete inset later
cur.paragraph().eraseChar(cur.pos(), b.params().track_changes); // we do not do it now to avoid memory reuse issues (see #10667).
DocIterator inset_it = cur;
// jump over inset
++cur.pos();
Buffer & b = *cur.buffer();
if (!plist.empty()) { if (!plist.empty()) {
// see bug 7319 // see bug 7319
// we clear the cache so that we won't get conflicts with labels // we clear the cache so that we won't get conflicts with labels
@ -1784,6 +1788,9 @@ bool Text::dissolveInset(Cursor & cur)
cur.pos() = min(cur.lastpos(), spos); cur.pos() = min(cur.lastpos(), spos);
} }
// delete the inset now
inset_it.paragraph().eraseChar(inset_it.pos(), b.params().track_changes);
cur.forceBufferUpdate(); cur.forceBufferUpdate();
// Ensure the current language is set correctly (bug 6292) // Ensure the current language is set correctly (bug 6292)