[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - 3 commits - sdext/source sw/source

[Michael Stahl]

 sdext/source/presenter/PresenterAccessibility.cxx |    6 ++++-
 sw/source/uibase/inc/conttree.hxx                 |    1 
 sw/source/uibase/utlui/content.cxx                |   26 ++++++----------------
 3 files changed, 13 insertions(+), 20 deletions(-)

New commits:
commit dbfa3841018672d8af8e9bf1bdb4caf6cdf0ce7d
Author: Michael Stahl <mstahl at redhat.com>
Date:   Thu Nov 24 14:18:05 2016 +0100

    tdf#103788 sw: fix use-after-free in navigator dialog
    
    The problem is that if SwContentTree::HasContentChanged() returns true,
    it may have deleted the SwTypeNumber instances that are referenced in
    SvTreeListEntry::pUserData, but it has not reset pUserData so those
    pointers are now used to acceess deleted objects.
    
    Also it looks like the HasContentChanged() detects additional conditions
    that would not cause a modified event from the document but should still
    cause a repaint, such as when the user moves the cursor between
    headings.
    
    Revert the optimization, it was a stupid idea.
    
    (regression from 329742e6c9da7cd7848d92a6846e3d1249d8d9b4)
    
    Change-Id: Idb5207e896b0638324fc41b7c214536be4ba864b
    (cherry picked from commit cbdf4e007650cfda4f7808402e8e24ae66d45792)
    Reviewed-on: https://gerrit.libreoffice.org/31194
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/source/uibase/inc/conttree.hxx b/sw/source/uibase/inc/conttree.hxx
index 525d11f..4dd2bf4d 100644
--- a/sw/source/uibase/inc/conttree.hxx
+++ b/sw/source/uibase/inc/conttree.hxx
@@ -96,7 +96,6 @@ class SwContentTree
     bool                m_bIsOutlineMoveable  :1;
     bool                m_bViewHasChanged     :1;
     bool                m_bIsImageListInitialized : 1;
-    bool                m_bActiveDocModified :1;
 
     static bool         bIsInDrag;
 
diff --git a/sw/source/uibase/utlui/content.cxx b/sw/source/uibase/utlui/content.cxx
index 3ef1c67..8493fec 100644
--- a/sw/source/uibase/utlui/content.cxx
+++ b/sw/source/uibase/utlui/content.cxx
@@ -798,7 +798,6 @@ SwContentTree::SwContentTree(vcl::Window* pParent, SwNavigationPI* pDialog)
     , m_bIsOutlineMoveable(true)
     , m_bViewHasChanged(false)
     , m_bIsImageListInitialized(false)
-    , m_bActiveDocModified(false)
     , m_bIsKeySpace(false)
 {
     SetHelpId(HID_NAVIGATOR_TREELIST);
@@ -1709,8 +1708,6 @@ void SwContentTree::Display( bool bActive )
         sal_Int32 nDelta = pVScroll->GetThumbPos() - nOldScrollPos;
         ScrollOutputArea( (short)nDelta );
     }
-
-    m_bActiveDocModified = false;
 }
 
 void SwContentTree::Clear()
@@ -2196,12 +2193,6 @@ void SwContentTree::SetConstantShell(SwWrtShell* pSh)
 
 void SwContentTree::Notify(SfxBroadcaster & rBC, SfxHint const& rHint)
 {
-    if (SFX_HINT_DOCCHANGED == rHint.GetId())
-    {
-        m_bActiveDocModified = true;
-        return;
-    }
-
     SfxViewEventHint const*const pVEHint(dynamic_cast<SfxViewEventHint const*>(&rHint));
     SwXTextView* pDyingShell = nullptr;
     if (m_pActiveShell && pVEHint && pVEHint->GetEventName() == "OnViewClosed")
@@ -2409,11 +2400,8 @@ IMPL_LINK_NOARG(SwContentTree, TimerUpdate, Timer *, void)
         else if( (m_bIsActive || (m_bIsConstant && pActShell == GetWrtShell())) &&
                     HasContentChanged())
         {
-            if (!m_bIsActive || m_bActiveDocModified)
-            {   // don't burn cpu and redraw and flicker if not modified
-                FindActiveTypeAndRemoveUserData();
-                Display(true);
-            }
+            FindActiveTypeAndRemoveUserData();
+            Display(true);
         }
     }
     else if(!pView && m_bIsActive && !m_bIsIdleClear)
commit 4f8eff151e8ec71eb1a5b6757d9b17d3224d67ca
Author: Michael Stahl <mstahl at redhat.com>
Date:   Wed Nov 23 23:01:41 2016 +0100

    SwContentTree: fix bad static downcasts
    
    Change-Id: I52c1b4a028928c3008d95df43dbc6e8183980df4
    (cherry picked from commit c2c4c6ee16120108590dc64f295ab54e34a05ac0)
    Reviewed-on: https://gerrit.libreoffice.org/31193
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/source/uibase/utlui/content.cxx b/sw/source/uibase/utlui/content.cxx
index 0693c90..3ef1c67 100644
--- a/sw/source/uibase/utlui/content.cxx
+++ b/sw/source/uibase/utlui/content.cxx
@@ -1404,8 +1404,9 @@ SdrObject* SwContentTree::GetDrawingObjectsByContent(const SwContent *pCnt)
 
 bool  SwContentTree::Expand( SvTreeListEntry* pParent )
 {
-    if(!m_bIsRoot || (static_cast<SwContentType*>(pParent->GetUserData())->GetType() == ContentTypeId::OUTLINE) ||
-            (m_nRootType == ContentTypeId::OUTLINE))
+    if (!m_bIsRoot
+        || (static_cast<SwTypeNumber*>(pParent->GetUserData())->GetTypeId() == CTYPE_CTT && static_cast<SwContentType*>(pParent->GetUserData())->GetType() == ContentTypeId::OUTLINE)
+        || (m_nRootType == ContentTypeId::OUTLINE))
     {
         if(lcl_IsContentType(pParent))
         {
@@ -1459,8 +1460,9 @@ bool  SwContentTree::Expand( SvTreeListEntry* pParent )
 
 bool  SwContentTree::Collapse( SvTreeListEntry* pParent )
 {
-    if(!m_bIsRoot || (static_cast<SwContentType*>(pParent->GetUserData())->GetType() == ContentTypeId::OUTLINE) ||
-            (m_nRootType == ContentTypeId::OUTLINE))
+    if (!m_bIsRoot
+        || (static_cast<SwTypeNumber*>(pParent->GetUserData())->GetTypeId() == CTYPE_CTT && static_cast<SwContentType*>(pParent->GetUserData())->GetType() == ContentTypeId::OUTLINE)
+        || (m_nRootType == ContentTypeId::OUTLINE))
     {
         if(lcl_IsContentType(pParent))
         {
commit c100e38b49512512b11a0c594f244a4937bc6d66
Author: Michael Stahl <mstahl at redhat.com>
Date:   Tue Nov 22 22:49:15 2016 +0100

    presenter console: fix STL assert when exiting slide show
    
    AtkListener::handleChildRemoved() calls removeAccessibleEventListener(),
    apparently without the listener being registered, so the remove() returns
    end(), which isn't valid for erase().
    
    (probably happens since e4e208fa2b0930be5a7cbbe2fab2ff2fe2c4a1ff)
    
    Change-Id: Ia0de1bafe214f5a46f250d6573d8c4b408c9cf26
    (cherry picked from commit f6d2ff1cb7f0f4917a0d4df38d5dcff8e37d20cc)
    Reviewed-on: https://gerrit.libreoffice.org/31192
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sdext/source/presenter/PresenterAccessibility.cxx b/sdext/source/presenter/PresenterAccessibility.cxx
index 7c474b2..48916ebf0 100644
--- a/sdext/source/presenter/PresenterAccessibility.cxx
+++ b/sdext/source/presenter/PresenterAccessibility.cxx
@@ -1109,7 +1109,11 @@ void SAL_CALL PresenterAccessible::AccessibleObject::removeAccessibleEventListen
     {
         const osl::MutexGuard aGuard(m_aMutex);
 
-        maListeners.erase(std::remove(maListeners.begin(), maListeners.end(), rxListener));
+        auto const it(std::remove(maListeners.begin(), maListeners.end(), rxListener));
+        if (it != maListeners.end())
+        {
+            maListeners.erase(it);
+        }
     }
 }