tdf#125982 a11y use-after-free of editengine

Change-Id: I467f0715b2e7e1e65faed19bd2a5e31939426bfd
Reviewed-on: https://gerrit.libreoffice.org/74378
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 8 insertions, 2 deletions

diff --git a/sc/source/ui/Accessibility/AccessibleDocument.cxx b/sc/source/ui/Accessibility/AccessibleDocument.cxx
index d6ccb9ea32cc..cac634524832 100644
--- a/sc/source/ui/Accessibility/AccessibleDocument.cxx
+++ b/sc/source/ui/Accessibility/AccessibleDocument.cxx
@@ -1493,9 +1493,15 @@ void ScAccessibleDocument::Notify( SfxBroadcaster& rBC, const SfxHint& rHint )
             if (mxTempAcc.is())
             {
                 if (mpTempAccEdit)
+                {
                     mpTempAccEdit->LostFocus();
-
-                mpTempAccEdit = nullptr;
+                    // tdf#125982 a11y use-after-free of editengine by
+                    // ScAccessibleEditObjectTextData living past the
+                    // the editengine of the editview passed in above
+                    // in ScAccEnterEditMode
+                    mpTempAccEdit->dispose();
+                    mpTempAccEdit = nullptr;
+                }
                 RemoveChild(mxTempAcc, true);
                 if (mpAccessibleSpreadsheet.is() && mpViewShell && mpViewShell->IsActive())
                     mpAccessibleSpreadsheet->GotFocus();