diff options
| author | Stephan Bergmann <sbergman@redhat.com> | 2022-04-19 16:45:02 +0200 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2022-04-19 18:31:24 +0200 |
| commit | 441e32d9555f410a0a2df995a70f9958cf2b0f1d (patch) | |
| tree | 0d15b93c20f9b7dfbca5030af5761017d5db236b /desktop | |
| parent | ab699bfdb3375f7142a50cc35322e2924c9e5945 (diff) | |
Fix heap-use-after-free
...when dp_gui::ExtensionRemovedListener::disposing
(desktop/source/deployment/gui/dp_gui_extlistbox.cxx) calls
> m_pParent->removeEntry( xPackage );
on an already destroyed m_pParent in e.g. the following scenario: In an
installation with some bundled extensions (e.g., --enable-ext-ct2n), "Tools -
Extension Manager...", deselect "Display Extensions - Bundled with LibreOffice",
"Close", "File - Exit LibreOffice".
It appears the issue was present ever since at least
051f7b163fa4bf1917fb3db98fed2a6a932a827e "jl152#i77196# Use ExtensionManager
instead of PackageManager"
Change-Id: I446cba382103828b97a2b1db9fa8afc207b73bc7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/133180
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Diffstat (limited to 'desktop')
| -rw-r--r-- | desktop/source/deployment/gui/dp_gui_extlistbox.cxx | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/desktop/source/deployment/gui/dp_gui_extlistbox.cxx b/desktop/source/deployment/gui/dp_gui_extlistbox.cxx index f66c016ea6a7..3b96147bbf02 100644 --- a/desktop/source/deployment/gui/dp_gui_extlistbox.cxx +++ b/desktop/source/deployment/gui/dp_gui_extlistbox.cxx @@ -1106,6 +1106,7 @@ void ExtensionBox_Impl::checkEntries() m_bHasActive = false; } m_vRemovedEntries.push_back(*iIndex); + (*iIndex)->m_xPackage->removeEventListener(m_xRemoveListener); iIndex = m_vEntries.erase(iIndex); } } |