svx: fix heap-use-after-free in PosSizePropertyPanel

How to reproduce: start Draw, add a shape, expand the "position and
size" property panel on the sidebar, quit -> boom

Asan reports:

==27725==ERROR: AddressSanitizer: heap-use-after-free on address 0x616000aa60c0 at pc 0x0000004a5d34 bp 0x7ffd28584a30 sp 0x7ffd285841e0
WRITE of size 40 at 0x616000aa60c0 thread T0
#0 0x4a5d33 in __asan_memcpy lode/packages/llvm-472c6ef8b0f53061b049039f9775ab127beafbe4.src/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:22
#1 0x7f18a3b304c7 in weld::Toolbar::connect_clicked(Link<rtl::OString const&, void> const&) /include/vcl/weld.hxx:1990:81
#2 0x7f18a3b2fece in ToolbarUnoDispatcher::dispose() /sfx2/source/toolbox/weldutils.cxx:129:17
#3 0x7f18a3b30144 in ToolbarUnoDispatcher::~ToolbarUnoDispatcher() /sfx2/source/toolbox/weldutils.cxx:133:49
#4 0x7f189b921f95 in std::default_delete<ToolbarUnoDispatcher>::operator()(ToolbarUnoDispatcher*) const lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:78:2
#5 0x7f189b91adf9 in std::unique_ptr<ToolbarUnoDispatcher, std::default_delete<ToolbarUnoDispatcher> >::reset(ToolbarUnoDispatcher*) lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:376:4
#6 0x7f189b8ef552 in svx::sidebar::PosSizePropertyPanel::dispose() /svx/source/sidebar/possize/PosSizePropertyPanel.cxx:149:23

...

freed by thread T0 here:
#0 0x4eb440 in operator delete(void*) lode/packages/llvm-472c6ef8b0f53061b049039f9775ab127beafbe4.src/compiler-rt/lib/asan/asan_new_delete.cc:166
#1 0x7f18806064f0 in (anonymous namespace)::SalInstanceToolbar::~SalInstanceToolbar() /vcl/source/app/salvtables.cxx:1123:5
#2 0x7f189ac45321 in std::default_delete<weld::Toolbar>::operator()(weld::Toolbar*) const lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:78:2
#3 0x7f189b91b0e9 in std::unique_ptr<weld::Toolbar, std::default_delete<weld::Toolbar> >::reset(weld::Toolbar*) lode/opt_private/gcc-7.3.0/lib64/gcc/x86_64-pc-linux-gnu/7.3.0/../../../../include/c++/7.3.0/bits/unique_ptr.h:376:4
#4 0x7f189b8ef46d in svx::sidebar::PosSizePropertyPanel::dispose() /svx/source/sidebar/possize/PosSizePropertyPanel.cxx:148:18

I.e. it's important to delete mxArrangeDispatch before mxArrangeTbx,
since the dispatch has a reference to the toolbox.

Change-Id: Ief294b492bc3778b0d39650a5642d21fa1db66f0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/86177
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins

0 files changed, 0 insertions, 0 deletions