Issue 106130 - svx: .ppt import. Crash when objects deleted when merged into a table are accessed
Summary: svx: .ppt import. Crash when objects deleted when merged into a table are acc...
Status: CLOSED FIXED
Alias: None
Product: Draw
Classification: Application
Component: code (show other issues)
Version: OOo 3.1.1
Hardware: All Linux, all
: P3 Trivial (vote)
Target Milestone: OOo 3.2
Assignee: wolframgarten
QA Contact: issues@graphics
URL:
Keywords:
Depends on:
Blocks: 99999
  Show dependency tree
 
Reported: 2009-10-21 09:56 UTC by caolanm
Modified: 2017-05-20 10:29 UTC (History)
1 user (show)

See Also:
Issue Type: PATCH
Latest Confirmation in: ---
Developer Difficulty: ---

Attachments
workaround patch (3.38 KB, patch)
2009-10-21 09:56 UTC, caolanm 		no flags Details | Diff
reproducer (1.75 MB, application/vnd.ms-powerpoint)
2009-10-21 09:58 UTC, caolanm 		no flags Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description caolanm 2009-10-21 09:56:30 UTC 
So, in this attached .ppt some objects get converted into a table with
CreateTable, but pointers to the object still exist in SvxMSDffManager and are
lookup by id later on.

Attached is a patch to remove these objects after the merge. (Even if this isn't
the right patch, or an alternative fix is used the replacement implementation
for SvxMSDffManager::removeShapeId should be used as the current one is
obviously wrong as the current one only examines the first entry in the map
Comment 1 caolanm 2009-10-21 09:56:48 UTC 
Created attachment 65498 [details]
workaround patch
Comment 2 caolanm 2009-10-21 09:58:04 UTC 
Created attachment 65499 [details]
reproducer
Comment 3 caolanm 2009-10-21 10:00:04 UTC 
given our custom allocator this might not crash every time as the object's
memory might not be handed back out or otherwise reclaimed yet but adding some
debug to SdrObject::~SdrObject and getShapeId will show the deletion and
subsequent hand back of the deleted pointer with id 0x1c07
Comment 4 sven.jacobi 2009-10-21 10:46:54 UTC 
I have nominated this issue as stopper for OOo3.2, so hopefully I can integrate
this patch with cws[impress180]
Comment 5 uwe.luebbers 2009-10-21 14:41:52 UTC 
set target
Comment 6 clippka 2009-10-22 10:56:33 UTC 
if pointers to SdrObjects will fail you... SdrObjectWeakRef won't
Comment 7 sven.jacobi 2009-10-22 12:11:43 UTC 
This issue has been fixed now in cws[impress180]. For the release I do not want
to change so much, so I will use the marvellousness ref shapes next time.
Comment 8 sven.jacobi 2009-10-23 16:35:40 UTC 
sj->wg: this issue is ready to be verified in cws[impress180]
Comment 9 wolframgarten 2009-10-28 09:48:07 UTC 
Verified in CWS.