[Libreoffice-commits] core.git: Branch 'libreoffice-6-2' - framework/source vcl/source

Caolán McNamara (via logerrit) logerrit at kemper.freedesktop.org
Tue Jun 25 19:11:09 UTC 2019


 framework/source/uielement/menubarmanager.cxx |    4 +++-
 vcl/source/control/menubtn.cxx                |    4 ++++
 vcl/source/window/menu.cxx                    |    3 +++
 3 files changed, 10 insertions(+), 1 deletion(-)

New commits:
commit a4f67bce94b080062edf8cd5ba7113d5e384d63d
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 25 14:00:20 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Tue Jun 25 21:10:27 2019 +0200

    tdf#126054 uses after free when menubutton and menu torn down during execution
    
    Change-Id: Ib79da121941863421bc12afa27e27cdd7e2e81e3
    Reviewed-on: https://gerrit.libreoffice.org/74697
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/framework/source/uielement/menubarmanager.cxx b/framework/source/uielement/menubarmanager.cxx
index 022f5d766c5d..03ae835a16ba 100644
--- a/framework/source/uielement/menubarmanager.cxx
+++ b/framework/source/uielement/menubarmanager.cxx
@@ -890,7 +890,9 @@ IMPL_LINK( MenuBarManager, Select, Menu *, pMenu, bool )
         }
     }
 
-    if ( xDispatch.is() )
+    // tdf#126054 don't let dispatch destroy this until after function completes
+    rtl::Reference<MenuBarManager> xRef(this);
+    if (xDispatch.is())
     {
         SolarMutexReleaser aReleaser;
         xDispatch->dispatch( aTargetURL, aArgs );
diff --git a/vcl/source/control/menubtn.cxx b/vcl/source/control/menubtn.cxx
index c6f6123c1a92..ccf336a46375 100644
--- a/vcl/source/control/menubtn.cxx
+++ b/vcl/source/control/menubtn.cxx
@@ -51,6 +51,10 @@ void MenuButton::ExecuteMenu()
         Point aPos(0, 1);
         tools::Rectangle aRect(aPos, aSize );
         mpMenu->Execute(this, aRect, PopupMenuFlags::ExecuteDown);
+
+        if (IsDisposed())
+            return;
+
         mnCurItemId = mpMenu->GetCurItemId();
         msCurItemIdent = mpMenu->GetCurItemIdent();
     }
diff --git a/vcl/source/window/menu.cxx b/vcl/source/window/menu.cxx
index 5b56a929aaeb..2385f432c666 100644
--- a/vcl/source/window/menu.cxx
+++ b/vcl/source/window/menu.cxx
@@ -2966,6 +2966,9 @@ sal_uInt16 PopupMenu::ImplExecute( const VclPtr<vcl::Window>& pW, const tools::R
         aSz.setHeight( ImplCalcHeight( nEntries ) );
     }
 
+    // tdf#126054 hold this until after function completes
+    VclPtr<PopupMenu> m_xThis(this);
+
     pWin->SetFocusId( xFocusId );
     pWin->SetOutputSizePixel( aSz );
     if ( GetItemCount() )


More information about the Libreoffice-commits mailing list