diff options
author | Stephan Bergmann <sbergman@redhat.com> | 2023-04-03 10:39:59 +0200 |
---|---|---|
committer | Stephan Bergmann <sbergman@redhat.com> | 2023-04-03 13:56:31 +0200 |
commit | 637d588ef3eaed3b9896d8aff3ccab6eb100ab29 (patch) | |
tree | e91159eb46cab59a07ebda53bb732b6f214f6654 /include/sfx2 | |
parent | 6201b6468f53338f833dd93809cb4a78458114aa (diff) |
Fix heap-use-after-free
...seen with CppunitTest_desktop_lib
CPPUNIT_TEST_NAME=DesktopLOKTest::testControlState after
116b9d6ddf2b61186b29f0370234eec9c1bbe306 "Avoid conversions between OUString and
OString in VCL",
> ==883385==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000937904 at pc 0x7fe40a2ef6ad bp 0x7fff0a077390 sp 0x7fff0a077388
> READ of size 4 at 0x603000937904 thread T0
> #0 in rtl::OUString::equalsAsciiL(char const*, int) const at include/rtl/ustring.hxx:1279:21
> #1 in rtl::libreoffice_internal::ConstCharArrayDetector<char const [11], bool>::Type rtl::operator==<char const [11]>(rtl::OUString const&, char const (&) [11]) at include/rtl/ustring.hxx:1815:24
> #2 in JSDialogNotifyIdle::Invoke() at vcl/jsdialog/jsdialogbuilder.cxx:283:27
> #3 in JSDialogSender::flush() at vcl/inc/jsdialog/jsdialogbuilder.hxx:172:34
> #4 in JSDialogSender::sendClose() at vcl/jsdialog/jsdialogbuilder.cxx:345:5
> #5 in JSDialogSender::~JSDialogSender() at vcl/jsdialog/jsdialogbuilder.cxx:320:5
> #6 in JSInstanceBuilder::~JSInstanceBuilder() at vcl/jsdialog/jsdialogbuilder.cxx:706:1
> 0x603000937904 is located 4 bytes inside of 24-byte region [0x603000937900,0x603000937918)
> freed by thread T0 here:
> #0 in free at ~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 (workdir/LinkTarget/Executable/cppunittester +0x139452)
> #1 in void rtl::str::release<_rtl_uString>(_rtl_uString*) at sal/rtl/strtmpl.hxx:875:9
> #2 in rtl_uString_release at sal/rtl/ustring.cxx:1204:12
> #3 in rtl::OUString::~OUString() at include/rtl/ustring.hxx:546:13
> #4 in JSInstanceBuilder::~JSInstanceBuilder() at vcl/jsdialog/jsdialogbuilder.cxx:706:1
Change-Id: Ib95b4d16c7a7d74ad989716e7829de775ed0de8e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/149954
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Diffstat (limited to 'include/sfx2')
0 files changed, 0 insertions, 0 deletions