From 9ec54e92407cd632c4e38317f914edd557835a86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Fri, 17 Jun 2016 14:37:17 +0100
Subject: [PATCH] Resolves: tdf#90579 swap_single_to_multi_blocks seems broken

when there is associated data in the src. Its copies those pointers
into the block that will appear in the destination. Then can destroy
the source block, which deletes the contents of those pointers, and
then inserts the new block which has dangling pointers to the deleted
data.

https://gitlab.com/mdds/mdds/merge_requests/2

Change-Id: Id9614d95652c8032b03cb5748a284917043d8d21
---
 external/mdds/UnpackedTarball_mdds.mk |  1 +
 external/mdds/tdf90579.patch.0        | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 external/mdds/tdf90579.patch.0

diff --git a/external/mdds/UnpackedTarball_mdds.mk b/external/mdds/UnpackedTarball_mdds.mk
index c015f4c13f5a..bd57593e7d45 100644
--- a/external/mdds/UnpackedTarball_mdds.mk
+++ b/external/mdds/UnpackedTarball_mdds.mk
@@ -14,6 +14,7 @@ $(eval $(call gb_UnpackedTarball_set_tarball,mdds,$(MDDS_TARBALL)))
 $(eval $(call gb_UnpackedTarball_set_patchlevel,mdds,0))
 
 $(eval $(call gb_UnpackedTarball_add_patches,mdds,\
+        external/mdds/tdf90579.patch.0 \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/mdds/tdf90579.patch.0 b/external/mdds/tdf90579.patch.0
new file mode 100644
index 000000000000..5ef1bc74097d
--- /dev/null
+++ b/external/mdds/tdf90579.patch.0
@@ -0,0 +1,23 @@
+diff --git a/include/mdds/multi_type_vector_def.inl b/include/mdds/multi_type_vector_def.inl
+index 0e2a15a..fe9c767 100644
+--- include/mdds/multi_type_vector_def.inl
++++ include/mdds/multi_type_vector_def.inl
+@@ -2306,6 +2306,9 @@ void multi_type_vector<_CellBlockFunc, _EventFunc>::swap_single_to_multi_blocks(
+     {
+         // Source range is at the top of a block.
+ 
++        // Shrink the current block by erasing the top part.
++        element_block_func::erase(*blk_src->mp_data, 0, len);
++
+         if (src_tail_len == 0)
+         {
+             // the whole block needs to be replaced.
+@@ -2314,8 +2317,6 @@ void multi_type_vector<_CellBlockFunc, _EventFunc>::swap_single_to_multi_blocks(
+         }
+         else
+         {
+-            // Shrink the current block by erasing the top part.
+-            element_block_func::erase(*blk_src->mp_data, 0, len);
+             blk_src->m_size -= len;
+         }
+