svx/source/sidebar/possize/PosSizePropertyPanel.cxx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 4ace93b8295c13907c7ef649b125f049332853e1
Author: Miklos Vajna <vmik...@collabora.com>
AuthorDate: Fri Jan 3 14:54:22 2020 +0100
Commit: Miklos Vajna <vmik...@collabora.com>
CommitDate: Fri Jan 3 18:34:21 2020 +0100
svx: fix heap-use-after-free in PosSizePropertyPanel
How to reproduce: start Draw, add a shape, expand the "position and
size" property panel on the sidebar, quit -> boom
Asan reports:
==27725==ERROR: AddressSanitizer: heap-use-after-free on address
0x616000aa60c0 at pc 0x0000004a5d34 bp 0x7ffd28584a30 sp 0x7ffd285841e0
WRITE of size 40 at 0x616000aa60c0 thread T0
#0 0x4a5d33 in __asan_memcpy
lode/packages/llvm-472c6ef8b0f53061b049039f9775ab127beafbe4.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:22
#1 0x7f18a3b304c7 in weld::Toolbar::connect_clicked(Link<rtl::OString
const&, void> const&) /include/vcl/weld.hxx:1990:81
#2 0x7f18a3b2fece in ToolbarUnoDispatcher::dispose()
/sfx2/source/toolbox/weldutils.cxx:129:17
#3 0x7f18a3b30144 in ToolbarUnoDispatcher::~ToolbarUnoDispatcher()
/sfx2/source/toolbox/weldutils.cxx:133:49
#4 0x7f189b921f95 in
std::default_delete<ToolbarUnoDispatcher>::operator()(ToolbarUnoDispatcher*)
const
lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:78:2
#5 0x7f189b91adf9 in std::unique_ptr<ToolbarUnoDispatcher,
std::default_delete<ToolbarUnoDispatcher> >::reset(ToolbarUnoDispatcher*)
lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:376:4
#6 0x7f189b8ef552 in svx::sidebar::PosSizePropertyPanel::dispose()
/svx/source/sidebar/possize/PosSizePropertyPanel.cxx:149:23
...
freed by thread T0 here:
#0 0x4eb440 in operator delete(void*)
lode/packages/llvm-472c6ef8b0f53061b049039f9775ab127beafbe4.src/compiler-rt/lib/asan/asan_new_delete.cc:166
#1 0x7f18806064f0 in (anonymous
namespace)::SalInstanceToolbar::~SalInstanceToolbar()
/vcl/source/app/salvtables.cxx:1123:5
#2 0x7f189ac45321 in
std::default_delete<weld::Toolbar>::operator()(weld::Toolbar*) const
lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:78:2
#3 0x7f189b91b0e9 in std::unique_ptr<weld::Toolbar,
std::default_delete<weld::Toolbar> >::reset(weld::Toolbar*)
lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:376:4
#4 0x7f189b8ef46d in svx::sidebar::PosSizePropertyPanel::dispose()
/svx/source/sidebar/possize/PosSizePropertyPanel.cxx:148:18
I.e. it's important to delete mxArrangeDispatch before mxArrangeTbx,
since the dispatch has a reference to the toolbox.
Change-Id: Ief294b492bc3778b0d39650a5642d21fa1db66f0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/86177
Reviewed-by: Miklos Vajna <vmik...@collabora.com>
Tested-by: Jenkins
diff --git a/svx/source/sidebar/possize/PosSizePropertyPanel.cxx
b/svx/source/sidebar/possize/PosSizePropertyPanel.cxx
index 625769a28f84..681a6db6284c 100644
--- a/svx/source/sidebar/possize/PosSizePropertyPanel.cxx
+++ b/svx/source/sidebar/possize/PosSizePropertyPanel.cxx
@@ -144,8 +144,8 @@ void PosSizePropertyPanel::dispose()
mxFtFlip.reset();
mxFlipDispatch.reset();
mxFlipTbx.reset();
- mxArrangeTbx.reset();
mxArrangeDispatch.reset();
+ mxArrangeTbx.reset();
mxBtnEditChart.reset();
maTransfPosXControl.dispose();
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
