diff options
| author | Noel Grandin <noel.grandin@collabora.co.uk> | 2022-09-13 09:56:15 +0200 |
|---|---|---|
| committer | Noel Grandin <noel.grandin@collabora.co.uk> | 2022-09-13 13:53:24 +0200 |
| commit | eae7a05b94fcfdf0ae48adab2006fe0b82c95921 (patch) | |
| tree | 8756c5fc26584ac1e2dc07cd4db07115ba305775 /include | |
| parent | c0d09eb46665a0b2ab86f263cc95662f406d83d2 (diff) | |
ofz#50767 docxfuzzer: Indirect-leak in rtl_allocateMemory
Two fixes required here
(1) the unnecessary use of aggregation in SwXDrawPage, which leads to a
very confusing cycle that I don't fully follow. No indication why this
is necessary in the git history, has been this way since initial commit
(2) a ref-counting cycle through SvxShapeGroup and SvxDrawPage, use a
weak reference here to break the ref-counting cycle.
Change-Id: Ie7ec583960ed0864a073ad8489fb65964bd83080
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139828
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
Diffstat (limited to 'include')
| -rw-r--r-- | include/svx/unoshape.hxx | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/svx/unoshape.hxx b/include/svx/unoshape.hxx index 0eb3ef33101c..862cbb1a0766 100644 --- a/include/svx/unoshape.hxx +++ b/include/svx/unoshape.hxx @@ -428,7 +428,8 @@ class SVXCORE_DLLPUBLIC SvxShapeGroup final : public SvxShapeGroupAnyD, public css::drawing::XShapes2 { private: - rtl::Reference< SvxDrawPage> mxPage; + /// using a weak reference to prevent leaks via ref-counting cycles + unotools::WeakReference< SvxDrawPage> mxWeakPage; void addUnoShape( const css::uno::Reference< css::drawing::XShape >& xShape, size_t nPos ); void addShape(SvxShape& rShape, size_t nPos); |