[Libreoffice-commits] core.git: chart2/source

[Noel Grandin (via logerrit)]

 chart2/source/view/main/ChartItemPool.cxx |   25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

New commits:
commit f02a56b0f2a66b583e52dd91b548c666b3d4693c
Author:     Noel Grandin <noel.grandin at collabora.co.uk>
AuthorDate: Wed May 12 13:30:57 2021 +0200
Commit:     Stephan Bergmann <sbergman at redhat.com>
CommitDate: Wed May 12 17:44:40 2021 +0200

    fix ubsan use-after-free
    
    after
        commit 2ed8c34bca56c1a30d727b21d9096cb77e88197a
        Date:   Wed May 5 10:54:44 2021 +0200
        use a single global item pool for chart2 draw model
    
    Change-Id: I5f6b1b1917f60c9a8603b58368da8b34f174f7db
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/115478
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sbergman at redhat.com>

diff --git a/chart2/source/view/main/ChartItemPool.cxx b/chart2/source/view/main/ChartItemPool.cxx
index 8c2bf391953c..fef1b1f8f2d0 100644
--- a/chart2/source/view/main/ChartItemPool.cxx
+++ b/chart2/source/view/main/ChartItemPool.cxx
@@ -31,12 +31,15 @@
 #include <editeng/sizeitem.hxx>
 #include <svl/stritem.hxx>
 #include <svl/ilstitem.hxx>
+#include <comphelper/processfactory.hxx>
 #include <editeng/editids.hrc>
 #include <svx/svxids.hrc>
 #include <vector>
 
 #include <com/sun/star/chart2/LegendPosition.hpp>
 #include <com/sun/star/chart2/MovingAverageType.hpp>
+#include <com/sun/star/frame/XTerminateListener.hpp>
+#include <com/sun/star/frame/Desktop.hpp>
 
 namespace chart
 {
@@ -216,6 +219,24 @@ MapUnit ChartItemPool::GetMetric(sal_uInt16 /* nWhich */) const
 
 static rtl::Reference<SfxItemPool> g_Pool1, g_Pool2, g_Pool3;
 
+/** If we let the libc runtime clean us up, we trigger a crash */
+namespace
+{
+class TerminateListener : public ::cppu::WeakImplHelper< css::frame::XTerminateListener >
+{
+    void SAL_CALL queryTermination( const css::lang::EventObject& ) override
+    {}
+    void SAL_CALL notifyTermination( const css::lang::EventObject& ) override
+    {
+        g_Pool1.clear();
+        g_Pool2.clear();
+        g_Pool3.clear();
+    }
+    virtual void SAL_CALL disposing( const ::css::lang::EventObject& ) override
+    {}
+};
+};
+
 SfxItemPool& ChartItemPool::GetGlobalChartItemPool()
 {
     if (!g_Pool1)
@@ -232,6 +253,10 @@ SfxItemPool& ChartItemPool::GetGlobalChartItemPool()
 
         g_Pool2->SetSecondaryPool(g_Pool3.get());
         g_Pool1->FreezeIdRanges();
+
+        css::uno::Reference< css::frame::XDesktop2 > xDesktop = css::frame::Desktop::create(comphelper::getProcessComponentContext());
+        css::uno::Reference< css::frame::XTerminateListener > xListener( new TerminateListener );
+        xDesktop->addTerminateListener( xListener );
     }
     return *g_Pool1;
 }