[Libreoffice-commits] core.git: Branch 'libreoffice-6-2' - basic/source toolkit/source

[Libreoffice Gerrit user]

 basic/source/sbx/sbxarray.cxx     |    6 +++++-
 toolkit/source/awt/vclxwindow.cxx |    2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

New commits:
commit c906431aabf1e0c00f1048bf580beeb3d52349d9
Author:     Noel Grandin <noel.grandin at collabora.co.uk>
AuthorDate: Mon Jan 14 13:19:32 2019 +0200
Commit:     Noel Grandin <noel.grandin at collabora.co.uk>
CommitDate: Tue Jan 15 06:56:45 2019 +0100

    tdf#122250 Crash when running extension
    
    as a consequence of
    
        commit 4e07987ce8134312920682e3481c3f8e3d7b66c3
        Date:   Thu Aug 25 15:08:55 2016 +0200
        cid#1371154 Missing move assignment operator
    
    this extensions appears to pass bogus data into VCLXWindow::setProperty,
    so I had to workaround that when debugging
    
    Change-Id: Ib6728c0a990bd7cfbfed43d79b7560bd2f7f5a67
    Reviewed-on: https://gerrit.libreoffice.org/66296
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>

diff --git a/basic/source/sbx/sbxarray.cxx b/basic/source/sbx/sbxarray.cxx
index fc86839c1d24..1b7054f2d9f7 100644
--- a/basic/source/sbx/sbxarray.cxx
+++ b/basic/source/sbx/sbxarray.cxx
@@ -190,10 +190,14 @@ void SbxArray::Put( SbxVariable* pVar, sal_uInt16 nIdx )
                 if( eType != SbxOBJECT || pVar->GetClass() != SbxClassType::Object )
                     pVar->Convert( eType );
         SbxVariableRef& rRef = GetRef( nIdx );
+        // tdf#122250. It is possible that I hold the last reference to myself, so check, otherwise I might
+        // call SetFlag on myself after I have died.
+        bool removingMyself = rRef.get() && rRef->GetParameters() == this && GetRefCount() == 1;
         if(rRef.get() != pVar )
         {
             rRef = pVar;
-            SetFlag( SbxFlagBits::Modified );
+            if (!removingMyself)
+                SetFlag( SbxFlagBits::Modified );
         }
     }
 }
diff --git a/toolkit/source/awt/vclxwindow.cxx b/toolkit/source/awt/vclxwindow.cxx
index 108f6b36f7bc..86aa4dc1a292 100644
--- a/toolkit/source/awt/vclxwindow.cxx
+++ b/toolkit/source/awt/vclxwindow.cxx
@@ -1715,6 +1715,8 @@ void VCLXWindow::setProperty( const OUString& PropertyName, const css::uno::Any&
             WinBits nStyle = pWindow->GetStyle();
             sal_uInt16 nTmp = 0;
             Value >>= nTmp;
+            // clear any dodgy bits passed in, can come from dodgy extensions
+            nTmp &= o3tl::typed_flags<WindowBorderStyle>::mask;
             WindowBorderStyle nBorder = static_cast<WindowBorderStyle>(nTmp);
             if ( !bool(nBorder) )
             {