[Libreoffice-commits] core.git: sc/source

[Caolán McNamara (via logerrit)]

 sc/source/ui/Accessibility/AccessibleDocument.cxx |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

New commits:
commit cf13e1ddef974fb929916a9a4a54f37188b10389
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jun 19 20:45:12 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Jun 20 11:08:46 2019 +0200

    tdf#125982 a11y use-after-free of editengine
    
    Change-Id: I467f0715b2e7e1e65faed19bd2a5e31939426bfd
    Reviewed-on: https://gerrit.libreoffice.org/74378
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/source/ui/Accessibility/AccessibleDocument.cxx b/sc/source/ui/Accessibility/AccessibleDocument.cxx
index d6ccb9ea32cc..cac634524832 100644
--- a/sc/source/ui/Accessibility/AccessibleDocument.cxx
+++ b/sc/source/ui/Accessibility/AccessibleDocument.cxx
@@ -1493,9 +1493,15 @@ void ScAccessibleDocument::Notify( SfxBroadcaster& rBC, const SfxHint& rHint )
             if (mxTempAcc.is())
             {
                 if (mpTempAccEdit)
+                {
                     mpTempAccEdit->LostFocus();
-
-                mpTempAccEdit = nullptr;
+                    // tdf#125982 a11y use-after-free of editengine by
+                    // ScAccessibleEditObjectTextData living past the
+                    // the editengine of the editview passed in above
+                    // in ScAccEnterEditMode
+                    mpTempAccEdit->dispose();
+                    mpTempAccEdit = nullptr;
+                }
                 RemoveChild(mxTempAcc, true);
                 if (mpAccessibleSpreadsheet.is() && mpViewShell && mpViewShell->IsActive())
                     mpAccessibleSpreadsheet->GotFocus();