ITEM: corrected error for SfxSetItem

Secured usage of FontList in SvxFontListItem
usage (a test)

Change-Id: I412a7681b3ece4e5d3751165d4b566ccdf5b2da9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163257
Tested-by: Jenkins
Reviewed-by: Armin Le Grand <Armin.Le.Grand@me.com>

5 files changed, 20 insertions, 29 deletions

diff --git a/extensions/source/propctrlr/controlfontdialog.cxx b/extensions/source/propctrlr/controlfontdialog.cxx
index 3887190752d3..bc97c5f1f0c1 100644
--- a/extensions/source/propctrlr/controlfontdialog.cxx
+++ b/extensions/source/propctrlr/controlfontdialog.cxx
@@ -37,6 +37,7 @@ namespace pcr
 
     OControlFontDialog::OControlFontDialog(const Reference< XComponentContext >& _rxContext )
     : OGenericUnoDialog( _rxContext )
+    , maFontList(Application::GetDefaultDevice())
     {
         registerProperty(PROPERTY_INTROSPECTEDOBJECT, static_cast<sal_Int32>(OwnPropertyId::INTROSPECTEDOBJECT),
             PropertyAttribute::BOUND | PropertyAttribute::TRANSIENT,
@@ -111,7 +112,7 @@ namespace pcr
 
     std::unique_ptr<weld::DialogController> OControlFontDialog::createDialog(const css::uno::Reference<css::awt::XWindow>& rParent)
     {
-        ControlCharacterDialog::createItemSet(m_pFontItems, m_pItemPool);
+        ControlCharacterDialog::createItemSet(m_pFontItems, m_pItemPool, maFontList);
 
         OSL_ENSURE(m_xControlModel.is(), "OControlFontDialog::createDialog: no introspectee set!");
         if (m_xControlModel.is())
diff --git a/extensions/source/propctrlr/controlfontdialog.hxx b/extensions/source/propctrlr/controlfontdialog.hxx
index 63bbae359de6..29dd95d2192a 100644
--- a/extensions/source/propctrlr/controlfontdialog.hxx
+++ b/extensions/source/propctrlr/controlfontdialog.hxx
@@ -21,6 +21,7 @@
 
 #include <comphelper/proparrhlp.hxx>
 #include <svtools/genericunodialog.hxx>
+#include <svtools/ctrltool.hxx>
 
 class SfxItemSet;
 class SfxItemPool;
@@ -44,6 +45,7 @@ namespace pcr
 
         std::unique_ptr<SfxItemSet> m_pFontItems;       // item set for the dialog
         rtl::Reference<SfxItemPool> m_pItemPool;            // item pool for the item set for the dialog
+        FontList maFontList;
 
     public:
         explicit OControlFontDialog(const css::uno::Reference< css::uno::XComponentContext >& _rxContext);
diff --git a/extensions/source/propctrlr/fontdialog.cxx b/extensions/source/propctrlr/fontdialog.cxx
index 17401748f67a..c84f13f9047d 100644
--- a/extensions/source/propctrlr/fontdialog.cxx
+++ b/extensions/source/propctrlr/fontdialog.cxx
@@ -529,24 +529,7 @@ namespace pcr
 
         public:
             virtual size_t size() const override { return maItemInfos.size(); }
-            virtual const ItemInfo& getItemInfo(size_t nIndex, SfxItemPool& /*rPool*/) override
-            {
-                const ItemInfo& rRetval(maItemInfos[nIndex]);
-
-                // return immediately if we have the static entry and Item
-                if (nullptr != rRetval.getItem())
-                    return rRetval;
-
-                // check for dynamic ItemInfo creation, needed here for FontList.
-                // this will be deleted when the Pool where it gets used goes down,
-                // thus may happen multiple times. ownership will be at the pool.
-                if (FontItemIds::CFID_FONTLIST == rRetval.getWhich())
-                    return *new ItemInfoDynamic(
-                        rRetval,
-                        new SvxFontListItem(new FontList(Application::GetDefaultDevice()), FontItemIds::CFID_FONTLIST));
-
-                return rRetval;
-            }
+            virtual const ItemInfo& getItemInfo(size_t nIndex, SfxItemPool& /*rPool*/) override { return maItemInfos[nIndex]; }
         };
 
         static std::unique_ptr<ItemInfoPackageCntChrDlg> g_aItemInfoPackageCntChrDlg;
@@ -555,13 +538,21 @@ namespace pcr
         return *g_aItemInfoPackageCntChrDlg;
     }
 
-    void ControlCharacterDialog::createItemSet(std::unique_ptr<SfxItemSet>& _rpSet, rtl::Reference<SfxItemPool>& _rpPool)
+    void ControlCharacterDialog::createItemSet(std::unique_ptr<SfxItemSet>& _rpSet, rtl::Reference<SfxItemPool>& _rpPool, FontList& rFontList)
     {
         // just to be sure...
         _rpSet = nullptr;
         _rpPool = nullptr;
         _rpPool = new SfxItemPool("PCRControlFontItemPool");
-        _rpPool->registerItemInfoPackage(getItemInfoPackageCntChrDlg());
+        _rpPool->registerItemInfoPackage(
+            getItemInfoPackageCntChrDlg(),
+            [&rFontList](sal_uInt16 nWhich)
+            {
+                SfxPoolItem* pRetval(nullptr);
+                if (FontItemIds::CFID_FONTLIST == nWhich)
+                    pRetval = new SvxFontListItem(&rFontList, FontItemIds::CFID_FONTLIST);
+                return pRetval;
+            });
 
         // and, finally, the set
         _rpSet.reset(new SfxItemSet(*_rpPool));
@@ -569,17 +560,11 @@ namespace pcr
 
     void ControlCharacterDialog::destroyItemSet(std::unique_ptr<SfxItemSet>& _rpSet, rtl::Reference<SfxItemPool>& _rpPool)
     {
-        // from the pool, get and remember the font list (needs to be deleted)
-        const SvxFontListItem& rFontListItem = static_cast<const SvxFontListItem&>(_rpPool->GetUserOrPoolDefaultItem(FontItemIds::CFID_FONTLIST));
-        const FontList* pFontList = rFontListItem.GetFontList();
-
         // _first_ delete the set (referring the pool)
         _rpSet.reset();
 
         // delete the pool
         _rpPool = nullptr;
-
-        delete pFontList;
     }
 
     void ControlCharacterDialog::PageCreated(const OUString& rId, SfxTabPage& rPage)
diff --git a/extensions/source/propctrlr/fontdialog.hxx b/extensions/source/propctrlr/fontdialog.hxx
index de184df5e841..07d72a600f4d 100644
--- a/extensions/source/propctrlr/fontdialog.hxx
+++ b/extensions/source/propctrlr/fontdialog.hxx
@@ -22,6 +22,7 @@
 #include <sfx2/tabdlg.hxx>
 #include <com/sun/star/beans/XPropertySet.hpp>
 #include <com/sun/star/beans/NamedValue.hpp>
+#include <svtools/ctrltool.hxx>
 
 
 namespace pcr
@@ -36,7 +37,7 @@ namespace pcr
         virtual ~ControlCharacterDialog() override;
 
         /// creates an item set to be used with this dialog
-        static void         createItemSet(std::unique_ptr<SfxItemSet>& _rpSet, rtl::Reference<SfxItemPool>& _rpPool);
+        static void         createItemSet(std::unique_ptr<SfxItemSet>& _rpSet, rtl::Reference<SfxItemPool>& _rpPool, FontList& rFontList);
 
         /// destroys an item previously created with <method>createItemSet</method>
         static void         destroyItemSet(std::unique_ptr<SfxItemSet>& _rpSet, rtl::Reference<SfxItemPool>& _rpPool);
diff --git a/extensions/source/propctrlr/formcomponenthandler.cxx b/extensions/source/propctrlr/formcomponenthandler.cxx
index 9527da83298f..24ea0c6dd7ef 100644
--- a/extensions/source/propctrlr/formcomponenthandler.cxx
+++ b/extensions/source/propctrlr/formcomponenthandler.cxx
@@ -103,6 +103,7 @@
 #include <comphelper/diagnose_ex.hxx>
 #include <sal/macros.h>
 #include <sal/log.hxx>
+#include <vcl/svapp.hxx>
 
 #include <limits>
 #include <memory>
@@ -2834,7 +2835,8 @@ namespace pcr
         // create an item set for use with the dialog
         std::unique_ptr<SfxItemSet> pSet;
         rtl::Reference<SfxItemPool> pPool;
-        ControlCharacterDialog::createItemSet(pSet, pPool);
+        FontList aFontList(Application::GetDefaultDevice());
+        ControlCharacterDialog::createItemSet(pSet, pPool, aFontList);
         ControlCharacterDialog::translatePropertiesToItems(m_xComponent, pSet.get());
 
         {   // do this in an own block. The dialog needs to be destroyed before we call