[Libreoffice-commits] core.git: Branch 'libreoffice-7-2' - sw/source

[Noel Grandin (via logerrit)]

 sw/source/uibase/uiview/uivwimp.cxx |    2 ++
 1 file changed, 2 insertions(+)

New commits:
commit caad77052f9d0c9e59ce8231d67827f2106fbc60
Author:     Noel Grandin <noel.grandin at collabora.co.uk>
AuthorDate: Fri Jul 2 11:19:39 2021 +0200
Commit:     Noel Grandin <noel.grandin at collabora.co.uk>
CommitDate: Fri Jul 2 21:47:09 2021 +0200

    fix potential use-after-free in SwClipboardChangeListener
    
    we think we're seeing this in COOL
    
    Change-Id: I29a287b032158076a99a836d98113d1623ebef99
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118277
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>
    (cherry picked from commit 558dface96fbc5f487b16cfa1bf3c3ea20776331)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118302

diff --git a/sw/source/uibase/uiview/uivwimp.cxx b/sw/source/uibase/uiview/uivwimp.cxx
index 336ce8de1975..6ad240701960 100644
--- a/sw/source/uibase/uiview/uivwimp.cxx
+++ b/sw/source/uibase/uiview/uivwimp.cxx
@@ -287,6 +287,8 @@ SwClipboardChangeListener::~SwClipboardChangeListener()
 
 void SAL_CALL SwClipboardChangeListener::disposing( const EventObject& /*rEventObject*/ )
 {
+    SolarMutexGuard aGuard;
+    pView = nullptr; // so we don't touch the view if changedContents somehow fires afterwards
 }
 
 void SAL_CALL SwClipboardChangeListener::changedContents( const css::datatransfer::clipboard::ClipboardEvent& rEventObject )