[Libreoffice-commits] core.git: cui/source include/vcl vcl/source

[Julien Nabet]

 cui/source/dialogs/SpellDialog.cxx |    9 ++++++---
 include/vcl/texteng.hxx            |    2 +-
 vcl/source/edit/textdoc.hxx        |    7 ++++++-
 vcl/source/edit/texteng.cxx        |    6 ++++--
 4 files changed, 17 insertions(+), 7 deletions(-)

New commits:
commit 19910c461230f70bb9e98ad44db3525f0d755724
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Thu Sep 28 00:18:05 2017 +0200

    tdf#112658: fix leak when calling TextEngine::SetAttrib
    
    TextCharAttribList::RemoveAttrib lets a dangling pointer
    when release unique_ptr obj maAttribs[n]
    So retrieve a unique_ptr from the different layers until
    SentenceEditWindow_Impl::ChangeMarkedWord (SpellDialog.cxx).
    
    Change-Id: I734909dce86ec28d69c09b2a8c0fc4a6941f422a
    Reviewed-on: https://gerrit.libreoffice.org/42881
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/cui/source/dialogs/SpellDialog.cxx b/cui/source/dialogs/SpellDialog.cxx
index 82c91910d130..57358d89ad3a 100644
--- a/cui/source/dialogs/SpellDialog.cxx
+++ b/cui/source/dialogs/SpellDialog.cxx
@@ -1643,11 +1643,14 @@ void SentenceEditWindow_Impl::ChangeMarkedWord(const OUString& rNewWord, Languag
     ExtTextEngine* pTextEngine = GetTextEngine();
     pTextEngine->UndoActionStart();
     const TextCharAttrib*  pErrorAttrib = pTextEngine->FindCharAttrib( TextPaM(0, m_nErrorStart), TEXTATTR_SPELL_ERROR );
+    std::unique_ptr<TextCharAttrib> pReleasedErrorAttrib;
+    std::unique_ptr<TextCharAttrib> pReleasedLangAttrib;
+    std::unique_ptr<TextCharAttrib> pReleasedBackAttrib;
     DBG_ASSERT(pErrorAttrib, "no error attribute found");
     const SpellErrorDescription* pSpellErrorDescription = nullptr;
     if(pErrorAttrib)
     {
-        pTextEngine->RemoveAttrib(0, *pErrorAttrib);
+        pReleasedErrorAttrib = pTextEngine->RemoveAttrib(0, *pErrorAttrib);
         pSpellErrorDescription = &static_cast<const SpellErrorAttrib&>(pErrorAttrib->GetAttr()).GetErrorDescription();
     }
     const TextCharAttrib*  pBackAttrib = pTextEngine->FindCharAttrib( TextPaM(0, m_nErrorStart), TEXTATTR_SPELL_BACKGROUND );
@@ -1666,7 +1669,7 @@ void SentenceEditWindow_Impl::ChangeMarkedWord(const OUString& rNewWord, Languag
             nTextLen)
         {
             SpellLanguageAttrib aNewLangAttrib( static_cast<const SpellLanguageAttrib&>(pLangAttrib->GetAttr()).GetLanguage());
-            pTextEngine->RemoveAttrib(0, *pLangAttrib);
+            pReleasedLangAttrib = pTextEngine->RemoveAttrib(0, *pLangAttrib);
             pTextEngine->SetAttrib( aNewLangAttrib, 0, m_nErrorEnd + nDiffLen, nTextLen );
         }
     }
@@ -1675,7 +1678,7 @@ void SentenceEditWindow_Impl::ChangeMarkedWord(const OUString& rNewWord, Languag
     {
         std::unique_ptr<TextAttrib> pNewBackground(pBackAttrib->GetAttr().Clone());
         const sal_Int32 nStart = pBackAttrib->GetStart();
-        pTextEngine->RemoveAttrib(0, *pBackAttrib);
+        pReleasedBackAttrib = pTextEngine->RemoveAttrib(0, *pBackAttrib);
         pTextEngine->SetAttrib(*pNewBackground, 0, nStart, m_nErrorStart);
     }
     pTextEngine->SetModified(true);
diff --git a/include/vcl/texteng.hxx b/include/vcl/texteng.hxx
index c9fcb08c5a72..3abf26abf172 100644
--- a/include/vcl/texteng.hxx
+++ b/include/vcl/texteng.hxx
@@ -297,7 +297,7 @@ public:
     const TextCharAttrib*   FindCharAttrib( const TextPaM& rPaM, sal_uInt16 nWhich ) const;
 
     void                RemoveAttribs( sal_uInt32 nPara, sal_uInt16 nWhich );
-    void                RemoveAttrib( sal_uInt32 nPara, const TextCharAttrib& rAttrib );
+    std::unique_ptr<TextCharAttrib>     RemoveAttrib( sal_uInt32 nPara, const TextCharAttrib& rAttrib );
     void                RemoveAttribs( sal_uInt32 nPara );
     void                SetAttrib( const TextAttrib& rAttr, sal_uInt32 nPara, sal_Int32 nStart, sal_Int32 nEnd, bool bIdleFormatAndUpdate = true );
 
diff --git a/vcl/source/edit/textdoc.hxx b/vcl/source/edit/textdoc.hxx
index 1695f9f4c04b..5a6fd869b040 100644
--- a/vcl/source/edit/textdoc.hxx
+++ b/vcl/source/edit/textdoc.hxx
@@ -44,7 +44,12 @@ public:
 
     const TextCharAttrib& GetAttrib( sal_uInt16 n ) const { return *maAttribs[n].get(); }
     TextCharAttrib& GetAttrib( sal_uInt16 n )       { return *maAttribs[n].get(); }
-    void            RemoveAttrib( sal_uInt16 n )    { maAttribs[n].release(); maAttribs.erase( maAttribs.begin() + n ); }
+    std::unique_ptr<TextCharAttrib>  RemoveAttrib( sal_uInt16 n )
+    {
+        std::unique_ptr<TextCharAttrib> pReleased = std::move(maAttribs[n]);
+        maAttribs.erase( maAttribs.begin() + n );
+        return pReleased;
+    }
 
     void            InsertAttrib( TextCharAttrib* pAttrib );
 
diff --git a/vcl/source/edit/texteng.cxx b/vcl/source/edit/texteng.cxx
index acdb6b74c427..b847d13da856 100644
--- a/vcl/source/edit/texteng.cxx
+++ b/vcl/source/edit/texteng.cxx
@@ -2504,8 +2504,9 @@ void TextEngine::RemoveAttribs( sal_uInt32 nPara, sal_uInt16 nWhich )
     }
 }
 
-void TextEngine::RemoveAttrib( sal_uInt32 nPara, const TextCharAttrib& rAttrib )
+std::unique_ptr<TextCharAttrib> TextEngine::RemoveAttrib( sal_uInt32 nPara, const TextCharAttrib& rAttrib )
 {
+    std::unique_ptr<TextCharAttrib> pRet;
     if ( nPara < mpDoc->GetNodes().size() )
     {
         TextNode* pNode = mpDoc->GetNodes()[ nPara ];
@@ -2516,7 +2517,7 @@ void TextEngine::RemoveAttrib( sal_uInt32 nPara, const TextCharAttrib& rAttrib )
             {
                 if(&(rAttribs.GetAttrib( nAttr - 1 )) == &rAttrib)
                 {
-                    rAttribs.RemoveAttrib( nAttr -1 );
+                    pRet = rAttribs.RemoveAttrib( nAttr -1 );
                     break;
                 }
             }
@@ -2526,6 +2527,7 @@ void TextEngine::RemoveAttrib( sal_uInt32 nPara, const TextCharAttrib& rAttrib )
             FormatAndUpdate();
         }
     }
+    return pRet;
 }
 
 void TextEngine::SetAttrib( const TextAttrib& rAttr, sal_uInt32 nPara, sal_Int32 nStart, sal_Int32 nEnd, bool bIdleFormatAndUpdate )