framework/source/uielement/menubarmanager.cxx | 4 +++-
vcl/source/control/menubtn.cxx | 4 ++++
vcl/source/window/menu.cxx | 3 +++
3 files changed, 10 insertions(+), 1 deletion(-)
New commits:
commit a4f67bce94b080062edf8cd5ba7113d5e384d63d
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 25 14:00:20 2019 +0100
Commit: Caolán McNamara <caolanm at redhat.com>
CommitDate: Tue Jun 25 21:10:27 2019 +0200
tdf#126054 uses after free when menubutton and menu torn down during execution
Change-Id: Ib79da121941863421bc12afa27e27cdd7e2e81e3
Reviewed-on: https://gerrit.libreoffice.org/74697
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
diff --git a/framework/source/uielement/menubarmanager.cxx b/framework/source/uielement/menubarmanager.cxx
index 022f5d766c5d..03ae835a16ba 100644
--- a/framework/source/uielement/menubarmanager.cxx
+++ b/framework/source/uielement/menubarmanager.cxx
@@ -890,7 +890,9 @@ IMPL_LINK( MenuBarManager, Select, Menu *, pMenu, bool )
}
}
- if ( xDispatch.is() )
+ // tdf#126054 don't let dispatch destroy this until after function completes
+ rtl::Reference<MenuBarManager> xRef(this);
+ if (xDispatch.is())
{
SolarMutexReleaser aReleaser;
xDispatch->dispatch( aTargetURL, aArgs );
diff --git a/vcl/source/control/menubtn.cxx b/vcl/source/control/menubtn.cxx
index c6f6123c1a92..ccf336a46375 100644
--- a/vcl/source/control/menubtn.cxx
+++ b/vcl/source/control/menubtn.cxx
@@ -51,6 +51,10 @@ void MenuButton::ExecuteMenu()
Point aPos(0, 1);
tools::Rectangle aRect(aPos, aSize );
mpMenu->Execute(this, aRect, PopupMenuFlags::ExecuteDown);
+
+ if (IsDisposed())
+ return;
+
mnCurItemId = mpMenu->GetCurItemId();
msCurItemIdent = mpMenu->GetCurItemIdent();
}
diff --git a/vcl/source/window/menu.cxx b/vcl/source/window/menu.cxx
index 5b56a929aaeb..2385f432c666 100644
--- a/vcl/source/window/menu.cxx
+++ b/vcl/source/window/menu.cxx
@@ -2966,6 +2966,9 @@ sal_uInt16 PopupMenu::ImplExecute( const VclPtr<vcl::Window>& pW, const tools::R
aSz.setHeight( ImplCalcHeight( nEntries ) );
}
+ // tdf#126054 hold this until after function completes
+ VclPtr<PopupMenu> m_xThis(this);
+
pWin->SetFocusId( xFocusId );
pWin->SetOutputSizePixel( aSz );
if ( GetItemCount() )