From f7bb572e95be67427c396c02fceb564ee648bba8 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Jan 18 2013 15:56:17 +0000
Subject: Resolves: rhbz#894223 crash on export of .docx


---

diff --git a/0001-Resolves-fdo-48569-crash-on-export-to-.docx-of-inlin.patch b/0001-Resolves-fdo-48569-crash-on-export-to-.docx-of-inlin.patch
new file mode 100644
index 0000000..b6d9d0e
--- /dev/null
+++ b/0001-Resolves-fdo-48569-crash-on-export-to-.docx-of-inlin.patch
@@ -0,0 +1,90 @@
+From a010c4eaea6d6c45621a11d035f76266b0a5147c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Thu, 11 Oct 2012 12:20:07 +0100
+Subject: [PATCH] Resolves: fdo#48569 crash on export to .docx of inline
+ anchored frame
+
+we're currently deferring to the end of the text node to export
+the contents of frames. If its anchored as character then the
+sw::Frame (which is allocated on stack) has gone out of scope
+so this pointer points to junk. Copy it instead.
+
+Sill need to export frames property at some stage.
+
+Change-Id: Ib9f8c6857ce1afe6acba84986b692139e44a7aad
+(cherry picked from commit 60a93729c95d31edab50a905236faa9e38a81556)
+
+Signed-off-by: Eike Rathke <erack@redhat.com>
+---
+ sw/source/filter/ww8/docxattributeoutput.cxx | 16 ++++++++++------
+ sw/source/filter/ww8/docxattributeoutput.hxx |  2 +-
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
+index 179c2f6..7149e49 100644
+--- a/sw/source/filter/ww8/docxattributeoutput.cxx
++++ b/sw/source/filter/ww8/docxattributeoutput.cxx
+@@ -311,7 +311,10 @@ void DocxAttributeOutput::EndParagraph( ww8::WW8TableNodeInfoInner::Pointer_t pT
+     // Write the anchored frame if any
+     if ( m_pParentFrame )
+     {
+-        const SwFrmFmt& rFrmFmt = m_pParentFrame->GetFrmFmt( );
++        sw::Frame *pParentFrame = m_pParentFrame;
++        m_pParentFrame = NULL;
++
++        const SwFrmFmt& rFrmFmt = pParentFrame->GetFrmFmt( );
+         const SwNodeIndex* pNodeIndex = rFrmFmt.GetCntnt().GetCntntIdx();
+ 
+         sal_uLong nStt = pNodeIndex ? pNodeIndex->GetIndex()+1                  : 0;
+@@ -319,12 +322,13 @@ void DocxAttributeOutput::EndParagraph( ww8::WW8TableNodeInfoInner::Pointer_t pT
+ 
+         m_rExport.SaveData( nStt, nEnd );
+ 
+-        m_rExport.mpParentFrame = m_pParentFrame;
+-        m_pParentFrame = NULL;
++        m_rExport.mpParentFrame = pParentFrame;
+ 
+         m_rExport.WriteText( );
+ 
+         m_rExport.RestoreData();
++
++        delete pParentFrame;
+     }
+ }
+ 
+@@ -2396,8 +2400,8 @@ void DocxAttributeOutput::OutputFlyFrame_Impl( const sw::Frame &rFrame, const Po
+             break;
+         case sw::Frame::eTxtBox:
+             {
+-                // The frame output is postponed at the end of the anchor paragraph
+-                m_pParentFrame = &rFrame;
++                // The frame output is postponed to the end of the anchor paragraph
++                m_pParentFrame = new sw::Frame(rFrame);
+             }
+             break;
+         case sw::Frame::eOle:
+@@ -4455,7 +4459,7 @@ DocxAttributeOutput::~DocxAttributeOutput()
+     delete m_pEndnotesList, m_pEndnotesList = NULL;
+ 
+     delete m_pTableWrt, m_pTableWrt = NULL;
+-    m_pParentFrame = NULL;
++    delete m_pParentFrame;
+ }
+ 
+ DocxExport& DocxAttributeOutput::GetExport()
+diff --git a/sw/source/filter/ww8/docxattributeoutput.hxx b/sw/source/filter/ww8/docxattributeoutput.hxx
+index 4caf047..0d176e1 100644
+--- a/sw/source/filter/ww8/docxattributeoutput.hxx
++++ b/sw/source/filter/ww8/docxattributeoutput.hxx
+@@ -587,7 +587,7 @@ private:
+     // beginning of the next paragraph
+     DocxColBreakStatus m_nColBreakStatus;
+ 
+-    const sw::Frame *m_pParentFrame;
++    sw::Frame *m_pParentFrame;
+     // close of hyperlink needed
+     bool m_closeHyperlinkInThisRun;
+     bool m_closeHyperlinkInPreviousRun;
+-- 
+1.7.11.7
+
diff --git a/libreoffice.spec b/libreoffice.spec
index 9c8bb4e..38789d1 100644
--- a/libreoffice.spec
+++ b/libreoffice.spec
@@ -177,6 +177,7 @@ Patch59: 0003-Resolves-fdo-57532-restrict-page-sanity-check-to-non.patch
 Patch60: 0001-rhbz-890080-crash-in-SwXTextDocument-getRendererCoun.patch
 Patch61: 0001-fdo-59366-Document-Conversion-wizard-enable-StarOffi.patch
 Patch62: 0002-Resolves-fdo-58730-workaround-UL-LR-Space-100-proble.patch
+Patch63: 0001-Resolves-fdo-48569-crash-on-export-to-.docx-of-inlin.patch
 
 %{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
 %define instdir %{_libdir}
@@ -1068,7 +1069,8 @@ mv -f redhat.soc extras/source/palettes/standard.soc
 %patch59 -p1 -b .Resolves-fdo-57532-restrict-page-sanity-check-to-non.patch
 %patch60 -p1 -b .rhbz-890080-crash-in-SwXTextDocument-getRendererCoun.patch
 %patch61 -p1 -b .fdo-59366-Document-Conversion-wizard-enable-StarOffi.patch
-%patch62 -p1 -b .Resolves-fdo-58730-workaround-UL-LR-Space-100-proble.patch
+%patch62 -p1 -b .fdo-58730-workaround-UL-LR-Space-100-proble.patch
+%patch63 -p1 -b .fdo-48569-crash-on-export-to-.docx-of-inlin.patch
 
 # TODO: check this
 # these are horribly incomplete--empty translations and copied english
@@ -2361,6 +2363,7 @@ update-desktop-database %{_datadir}/applications &> /dev/null || :
 - Resolves: rhbz#890080 crash in SwXTextDocument::getRendererCount
 - Resolves: fdo#58730 ODF fo:margin 100% bug
 - Resolves: fdo#59366: Document Conversion wizard: enable "StarOffice" again
+- Resolves: rhbz#894223 crash on export of .docx
 
 * Thu Dec 06 2012 Stephan Bergmann <sbergman@redhat.com> - 1:3.5.7.2-7
 - Resolves: rendering documents in browser plug-in