summaryrefslogtreecommitdiff
path: root/oox
diff options
context:
space:
mode:
authorMichael Stahl <mstahl@redhat.com>2017-09-13 10:48:38 +0200
committerMichael Stahl <mstahl@redhat.com>2017-09-13 11:09:38 +0200
commit88c84e71e2559ec6d0b4f8c5101a149daa4a2b2b (patch)
tree93df490d18b94c66f0aaddc12ed769dc2ce82289 /oox
parentb5368c913d8fe574ddaf2d5424ab48ffd0fefd56 (diff)
tdf#112311 oox: fix UAF of std::shared_ptr
OOXMLFastContextHandlerShape::sendShape() deletes the parent context's ShapeTypeContext::mrTypeModel. It looks like the sendShape() can't be delayed because writerfilter wants to import the v:textbox content into a text frame. Keep the shape alive until the end of the containing context. Not sure if it's going to process the v:fill element properly, but at lest valgrind is happy. (probably regression from CWS writerfilter32bugfixes01) Change-Id: Ifeab84751a1b20b2f272c4dd74b7097deb5eece0
Diffstat (limited to 'oox')
-rw-r--r--oox/source/vml/vmlshapecontainer.cxx4
-rw-r--r--oox/source/vml/vmlshapecontext.cxx30
2 files changed, 20 insertions, 14 deletions
diff --git a/oox/source/vml/vmlshapecontainer.cxx b/oox/source/vml/vmlshapecontainer.cxx
index d2fea16ea195..366f2fdfbb6a 100644
--- a/oox/source/vml/vmlshapecontainer.cxx
+++ b/oox/source/vml/vmlshapecontainer.cxx
@@ -59,11 +59,11 @@ ShapeContainer::~ShapeContainer()
{
}
-ShapeType& ShapeContainer::createShapeType()
+std::shared_ptr<ShapeType> ShapeContainer::createShapeType()
{
std::shared_ptr< ShapeType > xShape( new ShapeType( mrDrawing ) );
maTypes.push_back( xShape );
- return *xShape;
+ return xShape;
}
void ShapeContainer::finalizeFragmentImport()
diff --git a/oox/source/vml/vmlshapecontext.cxx b/oox/source/vml/vmlshapecontext.cxx
index 84185d40ecfd..dc97726fd0cc 100644
--- a/oox/source/vml/vmlshapecontext.cxx
+++ b/oox/source/vml/vmlshapecontext.cxx
@@ -269,9 +269,12 @@ ContextHandlerRef ShapeContextBase::createShapeContext( ContextHandler2Helper co
return nullptr;
}
-ShapeTypeContext::ShapeTypeContext( ContextHandler2Helper const & rParent, ShapeType& rShapeType, const AttributeList& rAttribs ) :
- ShapeContextBase( rParent ),
- mrTypeModel( rShapeType.getTypeModel() )
+ShapeTypeContext::ShapeTypeContext(ContextHandler2Helper const & rParent,
+ std::shared_ptr<ShapeType> const& pShapeType,
+ const AttributeList& rAttribs)
+ : ShapeContextBase(rParent)
+ , m_pShapeType(pShapeType) // tdf#112311 keep it alive
+ , mrTypeModel( pShapeType->getTypeModel() )
{
// shape identifier and shape name
bool bHasOspid = rAttribs.hasAttribute( O_TOKEN( spid ) );
@@ -444,10 +447,11 @@ void ShapeTypeContext::setStyle( const OUString& rStyle )
}
}
-ShapeContext::ShapeContext( ContextHandler2Helper const & rParent, ShapeBase& rShape, const AttributeList& rAttribs ) :
- ShapeTypeContext( rParent, rShape, rAttribs ),
- mrShape( rShape ),
- mrShapeModel( rShape.getShapeModel() )
+ShapeContext::ShapeContext(ContextHandler2Helper const & rParent,
+ std::shared_ptr<ShapeBase> pShape, const AttributeList& rAttribs)
+ : ShapeTypeContext( rParent, pShape, rAttribs )
+ , mrShape( *pShape )
+ , mrShapeModel( pShape->getShapeModel() )
{
// collect shape specific attributes
mrShapeModel.maType = rAttribs.getXString( XML_type, OUString() );
@@ -534,9 +538,10 @@ void ShapeContext::setVmlPath( const OUString& rPath )
mrShapeModel.maVmlPath = rPath;
}
-GroupShapeContext::GroupShapeContext( ContextHandler2Helper const & rParent, GroupShape& rShape, const AttributeList& rAttribs ) :
- ShapeContext( rParent, rShape, rAttribs ),
- mrShapes( rShape.getChildren() )
+GroupShapeContext::GroupShapeContext(ContextHandler2Helper const & rParent,
+ std::shared_ptr<GroupShape> pShape, const AttributeList& rAttribs)
+ : ShapeContext( rParent, pShape, rAttribs )
+ , mrShapes( pShape->getChildren() )
{
}
@@ -548,8 +553,9 @@ ContextHandlerRef GroupShapeContext::onCreateContext( sal_Int32 nElement, const
return xContext.get() ? xContext : ShapeContext::onCreateContext( nElement, rAttribs );
}
-RectangleShapeContext::RectangleShapeContext( ContextHandler2Helper const & rParent, const AttributeList& rAttribs, RectangleShape& rShape ) :
- ShapeContext( rParent, rShape, rAttribs )
+RectangleShapeContext::RectangleShapeContext(ContextHandler2Helper const & rParent,
+ const AttributeList& rAttribs, std::shared_ptr<RectangleShape> pShape)
+ : ShapeContext( rParent, pShape, rAttribs )
{
}