diff options
| author | Michael Stahl <michael.stahl@allotropia.de> | 2025-03-19 13:01:27 +0100 |
|---|---|---|
| committer | Thorsten Behrens <thorsten.behrens@allotropia.de> | 2025-03-19 15:43:04 +0100 |
| commit | b02a9f17c9b4148c49279346bb5f0cd07f4ce09c (patch) | |
| tree | 73ed5c955c37c5de7747cce80b50d6ad36c7916d /fileaccess | |
| parent | 7efa427be1ab482ef36a9771f89a7d29703131c0 (diff) | |
svl: fix SfxItemSet UBSan issue in test_tdf163325_toc_preview_crash
feature/cib_contract49d
SfxItemSet::ClearAllItemsImpl() decrements the refcount of items but
does not actually remove the items from the set.
This causes UBSan to report:
make -C sw -r UITest_writer_tests5 UITEST_TEST_NAME="tdf163325.tdf163325.test_tdf163325_toc_preview_crash"
include/svl/itemset.hxx:178:16: runtime error: downcast of address 0x60d000107030 which does not point to an object of type 'const SvxColorItem'
0x60d000107030: note: object has invalid vptr
00 00 00 00 21 05 80 45 00 00 00 00 00 00 00 00 03 00 be be a7 14 00 00 b8 be be be ff ff ff ff
^~~~~~~~~~~~~~~~~~~~~~~
invalid vptr
0 SvxColorItem const& SfxItemSet::Get<SvxColorItem>(TypedWhichId<SvxColorItem>, bool) const /include/svl/itemset.hxx:178:16
1 SwAttrSet::GetColor(bool) const /sw/inc/charatr.hxx:90:16
2 SwFont::SwFont(SwAttrSet const*, IDocumentSettingAccess const*) /sw/source/core/txtnode/swfont.cxx:763:25
3 SwTextFrame::EmptyHeight() const /sw/source/core/text/porrst.cxx:371:24
4 SwTextFrame::FormatEmpty() /sw/source/core/text/porrst.cxx:423:22
5 SwTextFrame::Format() /sw/source/core/text/frmform.cxx:2146:22
6 SwContentFrame::MakeAll() /sw/source/core/layout/calcmove.cxx:1611:17
7 SwFrame::PrepareMake() /sw/source/core/layout/calcmove.cxx:342:29
8 SwFrame::Calc() const /sw/source/core/layout/trvlfrm.cxx:1849:37
9 SwTextFrame::GetFormatted() /sw/source/core/text/txtfrm.cxx:3628:9
10 SwTextFrame::GetCharRect() const /sw/source/core/text/frmcrsr.cxx:197:13
11 SwCursorShell::UpdateCursor() /sw/source/core/crsr/crsrsh.cxx:2314:26
12 SwCursorShell::EndAction() /sw/source/core/crsr/crsrsh.cxx:280:5
13 SwEditShell::EndAllAction() /sw/source/core/edit/edws.cxx:102:25
14 SwDocShell::LoadStyles_() /sw/source/uibase/app/docst.cxx:1689:26
15 SwMultiTOXTabDialog::CreateExample_Hdl() /sw/source/ui/index/cntex.cxx:93:34
This was fixed in master towards libreoffice-25-2 by commit
290c8f6e048fedf63437e3fdf629555ac89dd3ad "ITEM: Change SfxItemSet to use
unordered_set" but that is slightly inappropriate to backport.
(regression from commit c1f3b34f871d2a6bb9ee7b912492be1164eec96f)
Change-Id: I4fecb3e50af22f35d0db4bf6b5788ade8bb6677f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183127
Tested-by: allotropia jenkins <jenkins@allotropia.de>
Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
Diffstat (limited to 'fileaccess')
0 files changed, 0 insertions, 0 deletions