summaryrefslogtreecommitdiff
path: root/include/sfx2
diff options
context:
space:
mode:
authorStephan Bergmann <sbergman@redhat.com>2023-04-03 10:39:59 +0200
committerStephan Bergmann <sbergman@redhat.com>2023-04-03 13:56:31 +0200
commit637d588ef3eaed3b9896d8aff3ccab6eb100ab29 (patch)
treee91159eb46cab59a07ebda53bb732b6f214f6654 /include/sfx2
parent6201b6468f53338f833dd93809cb4a78458114aa (diff)
Fix heap-use-after-free
...seen with CppunitTest_desktop_lib CPPUNIT_TEST_NAME=DesktopLOKTest::testControlState after 116b9d6ddf2b61186b29f0370234eec9c1bbe306 "Avoid conversions between OUString and OString in VCL", > ==883385==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000937904 at pc 0x7fe40a2ef6ad bp 0x7fff0a077390 sp 0x7fff0a077388 > READ of size 4 at 0x603000937904 thread T0 > #0 in rtl::OUString::equalsAsciiL(char const*, int) const at include/rtl/ustring.hxx:1279:21 > #1 in rtl::libreoffice_internal::ConstCharArrayDetector<char const [11], bool>::Type rtl::operator==<char const [11]>(rtl::OUString const&, char const (&) [11]) at include/rtl/ustring.hxx:1815:24 > #2 in JSDialogNotifyIdle::Invoke() at vcl/jsdialog/jsdialogbuilder.cxx:283:27 > #3 in JSDialogSender::flush() at vcl/inc/jsdialog/jsdialogbuilder.hxx:172:34 > #4 in JSDialogSender::sendClose() at vcl/jsdialog/jsdialogbuilder.cxx:345:5 > #5 in JSDialogSender::~JSDialogSender() at vcl/jsdialog/jsdialogbuilder.cxx:320:5 > #6 in JSInstanceBuilder::~JSInstanceBuilder() at vcl/jsdialog/jsdialogbuilder.cxx:706:1 > 0x603000937904 is located 4 bytes inside of 24-byte region [0x603000937900,0x603000937918) > freed by thread T0 here: > #0 in free at ~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 (workdir/LinkTarget/Executable/cppunittester +0x139452) > #1 in void rtl::str::release<_rtl_uString>(_rtl_uString*) at sal/rtl/strtmpl.hxx:875:9 > #2 in rtl_uString_release at sal/rtl/ustring.cxx:1204:12 > #3 in rtl::OUString::~OUString() at include/rtl/ustring.hxx:546:13 > #4 in JSInstanceBuilder::~JSInstanceBuilder() at vcl/jsdialog/jsdialogbuilder.cxx:706:1 Change-Id: Ib95b4d16c7a7d74ad989716e7829de775ed0de8e Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149954 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Diffstat (limited to 'include/sfx2')
0 files changed, 0 insertions, 0 deletions