From da291caaae96e0e46cd6891746587528cbbdd925 Mon Sep 17 00:00:00 2001
From: "Eike Rathke [er]" <erAck@sun.com>
Date: Fri, 2 Jul 2010 13:51:34 +0200
Subject: [PATCH] calc56: #i112849# Prevent hash from accessing dangling
 pointers

---
 sc/source/core/data/bcaslot.cxx | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/sc/source/core/data/bcaslot.cxx b/sc/source/core/data/bcaslot.cxx
index 95482b1c624b..540fb577a79b 100644
--- a/sc/source/core/data/bcaslot.cxx
+++ b/sc/source/core/data/bcaslot.cxx
@@ -136,10 +136,16 @@ ScBroadcastAreaSlot::ScBroadcastAreaSlot( ScDocument* pDocument,
 ScBroadcastAreaSlot::~ScBroadcastAreaSlot()
 {
     for ( ScBroadcastAreas::iterator aIter( aBroadcastAreaTbl.begin());
-            aIter != aBroadcastAreaTbl.end(); ++aIter)
+            aIter != aBroadcastAreaTbl.end(); /* none */)
     {
-        if (!(*aIter)->DecRef())
-            delete *aIter;
+        // Prevent hash from accessing dangling pointer in case area is
+        // deleted.
+        ScBroadcastArea* pArea = *aIter;
+        // Erase all so no hash will be accessed upon destruction of the
+        // hash_set.
+        aBroadcastAreaTbl.erase( aIter++);
+        if (!pArea->DecRef())
+            delete pArea;
     }
 }