Use weak reference to SfxObjectShell in SfxEventHint to avoid use-after-free

The events may be processed after the shell has been destroyed. This is
happening reliably after commit e2bfc34d146806a8f96be0cd2323d716f12cba4e
(Reimplement OleComponentNative_Impl to use IGlobalInterfaceTable,
2024-03-11) when controlling LibreOffice from external Java scripts; but
obviously, it could happen before as well.

Now SotObject inherits from cppu::OWeakObject, instead of SvRefBase.

Change-Id: I73a3531499a3068c801c98f40de39bdf8ad90b2b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164458
Tested-by: Mike Kaganski <mike.kaganski@collabora.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

9 files changed, 26 insertions, 24 deletions

diff --git a/include/editeng/svxacorr.hxx b/include/editeng/svxacorr.hxx
index 4bc359ddf8f8..d85a3d242783 100644
--- a/include/editeng/svxacorr.hxx
+++ b/include/editeng/svxacorr.hxx
@@ -24,6 +24,7 @@
 #include <o3tl/typed_flags_set.hxx>
 #include <o3tl/string_view.hxx>
 #include <i18nlangtag/languagetag.hxx>
+#include <rtl/ref.hxx>
 #include <tools/time.hxx>
 #include <tools/date.hxx>
 #include <editeng/swafopt.hxx>
@@ -200,10 +201,10 @@ class EDITENG_DLLPUBLIC SvxAutoCorrectLanguageLists
     bool IsFileChanged_Imp();
     void LoadXMLExceptList_Imp( std::unique_ptr<SvStringsISortDtor>& rpLst,
                                 const OUString& sStrmName,
-                                tools::SvRef<SotStorage>& rStg);
+                                rtl::Reference<SotStorage>& rStg);
     static void SaveExceptList_Imp( const SvStringsISortDtor& rLst,
                                 const OUString& sStrmName,
-                                tools::SvRef<SotStorage> const & rStg,
+                                rtl::Reference<SotStorage> const & rStg,
                                 bool bConvert = false);
 
     bool MakeBlocklist_Imp( SotStorage& rStg );
diff --git a/include/filter/msfilter/msdffimp.hxx b/include/filter/msfilter/msdffimp.hxx
index c48280c7a4a4..3b51d5b71424 100644
--- a/include/filter/msfilter/msdffimp.hxx
+++ b/include/filter/msfilter/msdffimp.hxx
@@ -535,7 +535,7 @@ protected:
 // the following method needs to be overridden for the import of OLE objects
     virtual bool GetOLEStorageName( sal_uInt32 nOLEId,
                                       OUString& rStorageName,
-                                      tools::SvRef<SotStorage>& rSrcStorage,
+                                      rtl::Reference<SotStorage>& rSrcStorage,
                                       css::uno::Reference < css::embed::XStorage >& xDestStg
                                     ) const;
 
@@ -630,7 +630,7 @@ public:
     static bool         ConvertToOle2( SvStream& rStm,
                                        sal_uInt32 nLen,
                                        const GDIMetaFile*,
-                                       const tools::SvRef<SotStorage> & rDest );
+                                       const rtl::Reference<SotStorage> & rDest );
 
     void SetModel(SdrModel* pModel, tools::Long nApplicationScale);
     SdrModel*  GetModel() const { return pSdrModel; }
@@ -718,7 +718,7 @@ public:
     static rtl::Reference<SdrOle2Obj> CreateSdrOLEFromStorage(
         SdrModel& rSdrModel,
         const OUString& rStorageName,
-        tools::SvRef<SotStorage> const & rSrcStorage,
+        rtl::Reference<SotStorage> const & rSrcStorage,
         const css::uno::Reference < css::embed::XStorage >& xDestStg,
         const Graphic& rGraf,
         const tools::Rectangle& rBoundRect,
diff --git a/include/filter/msfilter/svdfppt.hxx b/include/filter/msfilter/svdfppt.hxx
index 55a648a70354..5c77580e4507 100644
--- a/include/filter/msfilter/svdfppt.hxx
+++ b/include/filter/msfilter/svdfppt.hxx
@@ -655,7 +655,7 @@ public:
                                 const sal_uInt32* pTableArry,
                                 SvxMSDffSolverContainer* pSolverContainer
                             );
-    virtual bool ReadFormControl( tools::SvRef<SotStorage>& rSrc1, css::uno::Reference< css::form::XFormComponent > & rFormComp ) const = 0;
+    virtual bool ReadFormControl( rtl::Reference<SotStorage>& rSrc1, css::uno::Reference< css::form::XFormComponent > & rFormComp ) const = 0;
 };
 
 struct PPTTextParagraphStyleAtomInterpreter
@@ -1285,7 +1285,7 @@ public:
         ePageKind               ( ePKind ),
         mpPPTImporter           ( pPPTImporter )
     {};
-    bool ReadOCXStream( tools::SvRef<SotStorage>& rSrc1,
+    bool ReadOCXStream( rtl::Reference<SotStorage>& rSrc1,
         css::uno::Reference<css::drawing::XShape > *pShapeRef );
     virtual bool InsertControl(
         const css::uno::Reference< css::form::XFormComponent > &rFComp,
diff --git a/include/filter/msfilter/svxmsbas.hxx b/include/filter/msfilter/svxmsbas.hxx
index 304191ab7950..7d4578e98037 100644
--- a/include/filter/msfilter/svxmsbas.hxx
+++ b/include/filter/msfilter/svxmsbas.hxx
@@ -64,7 +64,7 @@ public:
     static OUString GetMSBasicStorageName();
 
 private:
-    tools::SvRef<SotStorage> xRoot;
+    rtl::Reference<SotStorage> xRoot;
     SfxObjectShell& rDocSh;
 };
 
diff --git a/include/oox/ole/olehelper.hxx b/include/oox/ole/olehelper.hxx
index a2810460bcd3..256896193903 100644
--- a/include/oox/ole/olehelper.hxx
+++ b/include/oox/ole/olehelper.hxx
@@ -25,9 +25,9 @@
 #include <oox/dllapi.h>
 #include <oox/helper/binarystreambase.hxx>
 #include <oox/helper/graphichelper.hxx>
+#include <rtl/ref.hxx>
 #include <rtl/ustring.hxx>
 #include <sal/types.h>
-#include <tools/ref.hxx>
 #include <memory>
 
 namespace com::sun::star {
@@ -183,10 +183,10 @@ protected:
 public:
     MSConvertOCXControls( const css::uno::Reference< css::frame::XModel >& rxModel );
     virtual ~MSConvertOCXControls() override;
-    bool ReadOCXStorage( tools::SvRef<SotStorage> const & rSrc1, css::uno::Reference< css::form::XFormComponent > & rxFormComp );
-    bool ReadOCXCtlsStream(tools::SvRef<SotStorageStream> const & rSrc1, css::uno::Reference< css::form::XFormComponent > & rxFormComp,
+    bool ReadOCXStorage( rtl::Reference<SotStorage> const & rSrc1, css::uno::Reference< css::form::XFormComponent > & rxFormComp );
+    bool ReadOCXCtlsStream(rtl::Reference<SotStorageStream> const & rSrc1, css::uno::Reference< css::form::XFormComponent > & rxFormComp,
                                    sal_Int32 nPos, sal_Int32 nSize );
-    static bool WriteOCXStream( const css::uno::Reference< css::frame::XModel >& rxModel, tools::SvRef<SotStorage> const &rSrc1, const css::uno::Reference< css::awt::XControlModel > &rControlModel, const css::awt::Size& rSize,OUString &rName);
+    static bool WriteOCXStream( const css::uno::Reference< css::frame::XModel >& rxModel, rtl::Reference<SotStorage> const &rSrc1, const css::uno::Reference< css::awt::XControlModel > &rControlModel, const css::awt::Size& rSize,OUString &rName);
     static bool WriteOCXExcelKludgeStream( const css::uno::Reference< css::frame::XModel >& rxModel, const css::uno::Reference< css::io::XOutputStream >& xOutStrm, const css::uno::Reference< css::awt::XControlModel > &rControlModel, const css::awt::Size& rSize,OUString &rName);
 };
 
diff --git a/include/sfx2/event.hxx b/include/sfx2/event.hxx
index 1024dd5b2423..0e4fd8977a7d 100644
--- a/include/sfx2/event.hxx
+++ b/include/sfx2/event.hxx
@@ -23,10 +23,12 @@
 
 #include <ostream>
 
+#include <unotools/weakref.hxx>
 #include <sfx2/dllapi.h>
 #include <svl/hint.hxx>
 #include <unotools/eventcfg.hxx>
 #include <rtl/ustring.hxx>
+#include <sfx2/objsh.hxx>
 
 #include <com/sun/star/uno/Sequence.hxx>
 #include <com/sun/star/frame/XController2.hpp>
@@ -111,8 +113,6 @@ inline std::basic_ostream<charT, traits> & operator <<(
     }
 }
 
-class SfxObjectShell;
-
 enum class SfxEventHintId {
     NONE = 0,
     ActivateDoc,
@@ -191,7 +191,7 @@ inline std::basic_ostream<charT, traits> & operator <<(
 
 class SFX2_DLLPUBLIC SfxEventHint : public SfxHint
 {
-    SfxObjectShell*     pObjShell;
+    unotools::WeakReference<SfxObjectShell> pObjShell;
     OUString            aEventName;
     SfxEventHintId      nEventId;
 
@@ -210,8 +210,7 @@ public:
     const OUString&     GetEventName() const
                         { return aEventName; }
 
-    SfxObjectShell*     GetObjShell() const
-                        { return pObjShell; }
+    rtl::Reference<SfxObjectShell> GetObjShell() const { return pObjShell.get(); }
 };
 
 
diff --git a/include/sfx2/objsh.hxx b/include/sfx2/objsh.hxx
index 3175cb283642..c961394db08c 100644
--- a/include/sfx2/objsh.hxx
+++ b/include/sfx2/objsh.hxx
@@ -176,7 +176,7 @@ template<class T> bool checkSfxObjectShell(const SfxObjectShell* pShell)
 }
 
 class SFX2_DLLPUBLIC SfxObjectShell :
-    public SfxShell, virtual public SotObject,
+    public SfxShell, public SotObject,
     public ::comphelper::IEmbeddedHelper
 {
 friend struct ModifyBlocker_Impl;
@@ -837,7 +837,7 @@ public:
     };
 
 
-typedef tools::SvRef<SfxObjectShell> SfxObjectShellRef;
+typedef rtl::Reference<SfxObjectShell> SfxObjectShellRef;
 
 class SfxObjectShellLock
 {
diff --git a/include/sot/object.hxx b/include/sot/object.hxx
index 1657986c8490..6cd3634bd557 100644
--- a/include/sot/object.hxx
+++ b/include/sot/object.hxx
@@ -22,10 +22,11 @@
 
 #include <sal/config.h>
 
-#include <tools/ref.hxx>
+#include <cppuhelper/weak.hxx>
+#include <rtl/ref.hxx>
 #include <sot/sotdllapi.h>
 
-class SOT_DLLPUBLIC SotObject : virtual public SvRefBase
+class SOT_DLLPUBLIC SotObject : public cppu::OWeakObject
 {
     sal_uInt16 nOwnerLockCount;
     bool bInClose; // TRUE, in DoClose
@@ -42,6 +43,7 @@ public:
     void OwnerLock(bool bLock);
     bool DoClose();
     bool IsInClose() const { return bInClose; }
+    oslInterlockedCount GetRefCount() const { return m_refCount; }
 
 private:
     SotObject& operator=(const SotObject&) = delete;
diff --git a/include/sot/storage.hxx b/include/sot/storage.hxx
index ac11340ac26d..2a49b4a39475 100644
--- a/include/sot/storage.hxx
+++ b/include/sot/storage.hxx
@@ -142,9 +142,9 @@ public:
 
     // create stream with connection to Storage,
     // more or less a Parent-Child relationship
-    tools::SvRef<SotStorageStream> OpenSotStream(const OUString & rEleName,
+    rtl::Reference<SotStorageStream> OpenSotStream(const OUString & rEleName,
                                      StreamMode = StreamMode::STD_READWRITE);
-    SotStorage* OpenSotStorage(const OUString & rEleName,
+    rtl::Reference<SotStorage> OpenSotStorage(const OUString & rEleName,
                                StreamMode = StreamMode::STD_READWRITE,
                                bool transacted = true);
 
@@ -161,7 +161,7 @@ public:
     static bool IsOLEStorage(const OUString & rFileName);
     static bool IsOLEStorage(SvStream* pStream);
 
-    static SotStorage* OpenOLEStorage(css::uno::Reference<css::embed::XStorage> const & xStorage,
+    static rtl::Reference<SotStorage> OpenOLEStorage(css::uno::Reference<css::embed::XStorage> const & xStorage,
                                       OUString const & rEleName, StreamMode = StreamMode::STD_READWRITE);
     static SotClipboardFormatId GetFormatID(css::uno::Reference<css::embed::XStorage> const & xStorage);
     static sal_Int32 GetVersion(css::uno::Reference<css::embed::XStorage> const & xStorage);