diff options
| author | Thomas Holder <thomas@thomas-holder.de> | 2019-10-27 06:35:34 +0000 |
|---|---|---|
| committer | Thomas Holder <thomas@thomas-holder.de> | 2019-10-27 06:35:34 +0000 |
| commit | 4b2fe2476292db84adc075d4fece8e57177a0e14 (patch) | |
| tree | 03d34a9d6f7567f04d8c4a073742d6c4c6502b97 /src/object/sp-tref.cpp | |
| parent | Clipboard: Fix pasting of image data on Windows (diff) | |
| download | inkscape-4b2fe2476292db84adc075d4fece8e57177a0e14.tar.gz inkscape-4b2fe2476292db84adc075d4fece8e57177a0e14.zip | |
fix heap-use-after-free on "Unlink Clone"
Reverts part of 6e5d89bf9595
Diffstat (limited to 'src/object/sp-tref.cpp')
| -rw-r--r-- | src/object/sp-tref.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/object/sp-tref.cpp b/src/object/sp-tref.cpp index 60ce63639..a99f8686f 100644 --- a/src/object/sp-tref.cpp +++ b/src/object/sp-tref.cpp @@ -483,6 +483,7 @@ sp_tref_convert_to_tspan(SPObject *obj) new_tspan->updateRepr(); // Hold onto our SPObject and repr for now. + sp_object_ref(tref); Inkscape::GC::anchor(tref_repr); // Remove ourselves, not propagating delete events to avoid a @@ -495,6 +496,7 @@ sp_tref_convert_to_tspan(SPObject *obj) // Establish the succession and let go of our object. tref->setSuccessor(new_tspan); + sp_object_unref(tref); } } //////////////////// |