Use weak reference to SfxObjectShell in SfxEventHint to avoid use-after-free

The events may be processed after the shell has been destroyed. This is
happening reliably after commit e2bfc34d146806a8f96be0cd2323d716f12cba4e
(Reimplement OleComponentNative_Impl to use IGlobalInterfaceTable,
2024-03-11) when controlling LibreOffice from external Java scripts; but
obviously, it could happen before as well.

Now SotObject inherits from cppu::OWeakObject, instead of SvRefBase.

Change-Id: I73a3531499a3068c801c98f40de39bdf8ad90b2b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164458
Tested-by: Mike Kaganski <mike.kaganski@collabora.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

18 files changed, 58 insertions, 58 deletions

diff --git a/sd/inc/drawdoc.hxx b/sd/inc/drawdoc.hxx
index 401bde6b5f88..f2a28131f888 100644
--- a/sd/inc/drawdoc.hxx
+++ b/sd/inc/drawdoc.hxx
@@ -68,7 +68,7 @@ namespace sd
 class DrawDocShell;
 #ifndef SV_DECL_DRAW_DOC_SHELL_DEFINED
 #define SV_DECL_DRAW_DOC_SHELL_DEFINED
-typedef ::tools::SvRef<DrawDocShell> DrawDocShellRef;
+typedef rtl::Reference<DrawDocShell> DrawDocShellRef;
 #endif
 class UndoManager;
 class ShapeList;
diff --git a/sd/inc/sdfilter.hxx b/sd/inc/sdfilter.hxx
index 1a8c8b6739a6..ef3fb7763210 100644
--- a/sd/inc/sdfilter.hxx
+++ b/sd/inc/sdfilter.hxx
@@ -20,8 +20,8 @@
 #pragma once
 
 #include <osl/module.h>
+#include <rtl/ref.hxx>
 #include <rtl/ustring.hxx>
-#include <tools/ref.hxx>
 #include <com/sun/star/beans/PropertyValue.hpp>
 #include <com/sun/star/frame/XModel.hpp>
 #include <com/sun/star/task/XStatusIndicator.hpp>
@@ -57,7 +57,7 @@ protected:
 };
 
 SD_DLLPUBLIC bool ExportPPT( const std::vector< css::beans::PropertyValue >& rMediaData,
-                    tools::SvRef<SotStorage> const & rSvStorage,
+                    rtl::Reference<SotStorage> const & rSvStorage,
                     css::uno::Reference< css::frame::XModel > const & rXModel,
                     css::uno::Reference< css::task::XStatusIndicator > const & rXStatInd,
                     SvMemoryStream* pVBA,
diff --git a/sd/inc/sdmod.hxx b/sd/inc/sdmod.hxx
index e1a2c51b6446..5008fc001f0b 100644
--- a/sd/inc/sdmod.hxx
+++ b/sd/inc/sdmod.hxx
@@ -104,7 +104,7 @@ public:
     void                    GetState(SfxItemSet&);
 
     SdOptions*              GetSdOptions(DocumentType eDocType);
-    SD_DLLPUBLIC tools::SvRef<SotStorageStream>     GetOptionStream( std::u16string_view rOptionName, SdOptionStreamMode eMode );
+    SD_DLLPUBLIC rtl::Reference<SotStorageStream> GetOptionStream( std::u16string_view rOptionName, SdOptionStreamMode eMode );
 
     bool                    GetWaterCan() const { return bWaterCan; }
     void                    SetWaterCan( bool bWC ) { bWaterCan = bWC; }
@@ -140,7 +140,7 @@ private:
     SdOptions*              pDrawOptions;
     std::unique_ptr<SvxSearchItem>      pSearchItem;
     std::unique_ptr<SvNumberFormatter>  pNumberFormatter;
-    tools::SvRef<SotStorage>            xOptionStorage;
+    rtl::Reference<SotStorage>          xOptionStorage;
     bool                    bWaterCan;
     std::unique_ptr<SfxErrorHandler> mpErrorHdl;
     /** This device is used for printer independent layout.  It is virtual
diff --git a/sd/source/filter/eppt/eppt.cxx b/sd/source/filter/eppt/eppt.cxx
index a239eaad2ef3..e6a71eb3f56c 100644
--- a/sd/source/filter/eppt/eppt.cxx
+++ b/sd/source/filter/eppt/eppt.cxx
@@ -65,7 +65,7 @@ using ::com::sun::star::beans::XPropertySet;
 
 //============================ PPTWriter ==================================
 
-PPTWriter::PPTWriter( tools::SvRef<SotStorage> xSvStorage,
+PPTWriter::PPTWriter( rtl::Reference<SotStorage> xSvStorage,
             css::uno::Reference< css::frame::XModel > const & rXModel,
             css::uno::Reference< css::task::XStatusIndicator > const & rXStatInd,
             SvMemoryStream* pVBA, sal_uInt32 nCnvrtFlags ) :
@@ -1251,16 +1251,16 @@ void PPTWriter::ImplWriteOLE( )
                     const ::uno::Reference < embed::XEmbeddedObject >& xObj( pSdrOle2Obj->GetObjRef() );
                     if( xObj.is() )
                     {
-                        tools::SvRef<SotStorage> xTempStorage( new SotStorage( new SvMemoryStream(), true ) );
+                        rtl::Reference<SotStorage> xTempStorage( new SotStorage( new SvMemoryStream(), true ) );
                         aOleExport.ExportOLEObject( xObj, *xTempStorage );
 
                         //TODO/MBA: testing
                         SvMemoryStream aStream;
-                        tools::SvRef<SotStorage> xCleanStorage( new SotStorage( false, aStream ) );
+                        rtl::Reference<SotStorage> xCleanStorage(new SotStorage(false, aStream));
                         xTempStorage->CopyTo( xCleanStorage.get() );
                         // create a dummy content stream, the dummy content is necessary for ppt, but not for
                         // doc files, so we can't share code.
-                        tools::SvRef<SotStorageStream> xStm = xCleanStorage->OpenSotStream( SVEXT_PERSIST_STREAM );
+                        rtl::Reference<SotStorageStream> xStm = xCleanStorage->OpenSotStream( SVEXT_PERSIST_STREAM );
                         xStm->WriteUInt32( 0 )        // no ClipboardId
                                .WriteUInt32( 4 )        // no target device
                                .WriteUInt32( 1 )        // aspect ratio
@@ -1283,7 +1283,7 @@ void PPTWriter::ImplWriteOLE( )
                     OUString aName;
                     //Initialize the graphic size which will be used on export
                     css::awt::Size  aSize( pPtr->xShape->getSize() );
-                    tools::SvRef<SotStorage> xDest( new SotStorage( new SvMemoryStream(), true ) );
+                    rtl::Reference<SotStorage> xDest(new SotStorage(new SvMemoryStream(), true));
                     bool bOk = oox::ole::MSConvertOCXControls::WriteOCXStream( mXModel, xDest, pPtr->xControlModel, aSize, aName );
                     if ( bOk )
                         pStrm = xDest->CreateMemoryStream();
@@ -1419,7 +1419,7 @@ void PPTWriter::ImplWriteAtomEnding()
 // - exported function -
 
 SAL_DLLPUBLIC_EXPORT bool ExportPPT( const std::vector< css::beans::PropertyValue >& rMediaData,
-                    tools::SvRef<SotStorage> const & rSvStorage,
+                    rtl::Reference<SotStorage> const & rSvStorage,
                     css::uno::Reference< css::frame::XModel > const & rXModel,
                     css::uno::Reference< css::task::XStatusIndicator > const & rXStatInd,
                     SvMemoryStream* pVBA,
@@ -1433,17 +1433,17 @@ SAL_DLLPUBLIC_EXPORT bool ExportPPT( const std::vector< css::beans::PropertyValu
 
 SAL_DLLPUBLIC_EXPORT bool SaveVBA( SfxObjectShell& rDocShell, SvMemoryStream*& pBas )
 {
-    tools::SvRef<SotStorage> xDest( new SotStorage( new SvMemoryStream(), true ) );
+    rtl::Reference<SotStorage> xDest(new SotStorage(new SvMemoryStream(), true));
     SvxImportMSVBasic aMSVBas( rDocShell, *xDest );
     aMSVBas.SaveOrDelMSVBAStorage( true, "_MS_VBA_Overhead" );
 
-    tools::SvRef<SotStorage> xOverhead = xDest->OpenSotStorage( "_MS_VBA_Overhead" );
+    rtl::Reference<SotStorage> xOverhead = xDest->OpenSotStorage("_MS_VBA_Overhead");
     if ( xOverhead.is() && ( xOverhead->GetError() == ERRCODE_NONE ) )
     {
-        tools::SvRef<SotStorage> xOverhead2 = xOverhead->OpenSotStorage( "_MS_VBA_Overhead" );
+        rtl::Reference<SotStorage> xOverhead2 = xOverhead->OpenSotStorage("_MS_VBA_Overhead");
         if ( xOverhead2.is() && ( xOverhead2->GetError() == ERRCODE_NONE ) )
         {
-            tools::SvRef<SotStorageStream> xTemp = xOverhead2->OpenSotStream( "_MS_VBA_Overhead2" );
+            rtl::Reference<SotStorageStream> xTemp = xOverhead2->OpenSotStream("_MS_VBA_Overhead2");
             if ( xTemp.is() && ( xTemp->GetError() == ERRCODE_NONE ) )
             {
                 sal_uInt32 nLen = xTemp->GetSize();
diff --git a/sd/source/filter/eppt/eppt.hxx b/sd/source/filter/eppt/eppt.hxx
index 635d5a2223a1..1ef07d1dcff4 100644
--- a/sd/source/filter/eppt/eppt.hxx
+++ b/sd/source/filter/eppt/eppt.hxx
@@ -127,10 +127,10 @@ class PPTWriter final : public PPTWriterBase, public PPTExBulletProvider
         bool                mbFontIndependentLineSpacing;
         sal_uInt32          mnTextSize;
 
-        tools::SvRef<SotStorage>        mrStg;
-        tools::SvRef<SotStorageStream>  mpCurUserStrm;
-        tools::SvRef<SotStorageStream>  mpStrm;
-        tools::SvRef<SotStorageStream>  mpPicStrm;
+        rtl::Reference<SotStorage>        mrStg;
+        rtl::Reference<SotStorageStream>  mpCurUserStrm;
+        rtl::Reference<SotStorageStream>  mpStrm;
+        rtl::Reference<SotStorageStream>  mpPicStrm;
         std::unique_ptr<PptEscherEx>    mpPptEscherEx;
 
         std::vector<std::unique_ptr<PPTExOleObjEntry>> maExOleObj;
@@ -217,7 +217,7 @@ class PPTWriter final : public PPTWriterBase, public PPTExBulletProvider
         virtual void        ImplWriteSlideMaster( sal_uInt32 nPageNum, css::uno::Reference< css::beans::XPropertySet > const & aXBackgroundPropSet ) override;
 
     public:
-                                PPTWriter( tools::SvRef<SotStorage> xSvStorage,
+                                PPTWriter( rtl::Reference<SotStorage> xSvStorage,
                                             css::uno::Reference< css::frame::XModel > const & rModel,
                                             css::uno::Reference< css::task::XStatusIndicator > const & rStatInd,
                                             SvMemoryStream* pVBA, sal_uInt32 nCnvrtFlags );
diff --git a/sd/source/filter/eppt/epptso.cxx b/sd/source/filter/eppt/epptso.cxx
index e6923533c92d..97a0f170edf0 100644
--- a/sd/source/filter/eppt/epptso.cxx
+++ b/sd/source/filter/eppt/epptso.cxx
@@ -1981,14 +1981,14 @@ void PPTWriter::ImplWritePage( const PHLayout& rLayout, EscherSolverContainer& a
 
                 css::awt::Size     aSize;
                 OUString          aControlName;
-                tools::SvRef<SotStorage>    xTemp( new SotStorage( new SvMemoryStream(), true ) );
+                rtl::Reference<SotStorage> xTemp(new SotStorage(new SvMemoryStream(), true));
                 if ( oox::ole::MSConvertOCXControls::WriteOCXStream( mXModel, xTemp, aXControlModel, aSize, aControlName ) )
                 {
                     OUString aUserName( xTemp->GetUserName() );
                     OUString aOleIdentifier;
                     if ( !aUserName.isEmpty() )
                     {
-                        tools::SvRef<SotStorageStream> xCompObj = xTemp->OpenSotStream(
+                        rtl::Reference<SotStorageStream> xCompObj = xTemp->OpenSotStream(
                             "\1CompObj",
                                 StreamMode::READ | StreamMode::NOCREATE | StreamMode::SHARE_DENYALL );
                         sal_uInt32 const nStreamLen = xCompObj->remainingSize();
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 83570ca2ba8f..5f5c4e87bcb4 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -127,7 +127,7 @@ SdPPTImport::SdPPTImport( SdDrawDocument* pDocument, SvStream& rDocStream, SotSt
     pSummaryInformation.reset();
 #endif
 
-    tools::SvRef<SotStorageStream> pCurrentUserStream(rStorage.OpenSotStream("Current User", StreamMode::STD_READ));
+    rtl::Reference<SotStorageStream> pCurrentUserStream(rStorage.OpenSotStream("Current User", StreamMode::STD_READ));
     if (pCurrentUserStream)
     {
         ReadPptCurrentUserAtom(*pCurrentUserStream, maParam.aCurrentUserAtom);
@@ -2746,7 +2746,7 @@ rtl::Reference<SdrObject> ImplSdPPTImport::ProcessObj( SvStream& rSt, DffObjData
 }
 
 bool
-ImplSdPPTImport::ReadFormControl( tools::SvRef<SotStorage>& rSrc1, css::uno::Reference< css::form::XFormComponent > & rFormComp ) const
+ImplSdPPTImport::ReadFormControl( rtl::Reference<SotStorage>& rSrc1, css::uno::Reference< css::form::XFormComponent > & rFormComp ) const
 {
     uno::Reference< frame::XModel > xModel;
     if (  mpDoc->GetDocSh() )
@@ -2771,11 +2771,11 @@ extern "C" SAL_DLLPUBLIC_EXPORT bool TestImportPPT(SvStream &rStream)
     bool bRet = false;
     try
     {
-        tools::SvRef<SotStorage> xStorage(new SotStorage(rStream));
+        rtl::Reference<SotStorage> xStorage(new SotStorage(rStream));
         if (xStorage->GetError())
             return false;
 
-        tools::SvRef<SotStorageStream> xDocStream(xStorage->OpenSotStream( "PowerPoint Document", StreamMode::STD_READ));
+        rtl::Reference<SotStorageStream> xDocStream(xStorage->OpenSotStream( "PowerPoint Document", StreamMode::STD_READ));
         if ( !xDocStream.is() )
             return false;
 
diff --git a/sd/source/filter/ppt/pptin.hxx b/sd/source/filter/ppt/pptin.hxx
index c0d239fd23c5..49f15925baf1 100644
--- a/sd/source/filter/ppt/pptin.hxx
+++ b/sd/source/filter/ppt/pptin.hxx
@@ -43,7 +43,7 @@ typedef ::std::map < SdrObject*, Ppt97AnimationPtr > tAnimationMap;
 
 class ImplSdPPTImport : public SdrPowerPointImport
 {
-    tools::SvRef<SotStorageStream> mxPicturesStream;
+    rtl::Reference<SotStorageStream> mxPicturesStream;
     SfxMedium&      mrMed;
     SotStorage&      mrStorage;
     DffRecordHeader maDocHd;
@@ -73,7 +73,7 @@ public:
     virtual ~ImplSdPPTImport() override;
 
     bool         Import();
-    virtual bool ReadFormControl(  tools::SvRef<SotStorage>& rSrc1, css::uno::Reference< css::form::XFormComponent > & rFormComp ) const override;
+    virtual bool ReadFormControl(  rtl::Reference<SotStorage>& rSrc1, css::uno::Reference< css::form::XFormComponent > & rFormComp ) const override;
 };
 
 class SdPPTImport
diff --git a/sd/source/filter/ppt/propread.hxx b/sd/source/filter/ppt/propread.hxx
index d5521a6020d5..94b8d12e13a6 100644
--- a/sd/source/filter/ppt/propread.hxx
+++ b/sd/source/filter/ppt/propread.hxx
@@ -23,6 +23,7 @@
 #include <vector>
 #include <memory>
 
+#include <rtl/ref.hxx>
 #include <sal/types.h>
 #include <sot/storage.hxx>
 #include <tools/stream.hxx>
@@ -133,7 +134,7 @@ class Section final
 class PropRead
 {
         bool                mbStatus;
-        tools::SvRef<SotStorageStream>      mpSvStream;
+        rtl::Reference<SotStorageStream> mpSvStream;
 
         sal_uInt16              mnByteOrder;
         sal_uInt8               mApplicationCLSID[ 16 ];
diff --git a/sd/source/filter/sdpptwrp.cxx b/sd/source/filter/sdpptwrp.cxx
index a4b0d90bfead..20ae1cba18c2 100644
--- a/sd/source/filter/sdpptwrp.cxx
+++ b/sd/source/filter/sdpptwrp.cxx
@@ -61,13 +61,13 @@ static void lcl_getListOfStreams(SotStorage * pStorage, comphelper::SequenceAsHa
         OUString sStreamFullName = sPrefix.size() ? OUString::Concat(sPrefix) + "/" + aElement.GetName() : aElement.GetName();
         if (aElement.IsStorage())
         {
-            tools::SvRef<SotStorage> xSubStorage = pStorage->OpenSotStorage(aElement.GetName(), StreamMode::STD_READ | StreamMode::SHARE_DENYALL);
+            rtl::Reference<SotStorage> xSubStorage = pStorage->OpenSotStorage(aElement.GetName(), StreamMode::STD_READ | StreamMode::SHARE_DENYALL);
             lcl_getListOfStreams(xSubStorage.get(), aStreamsData, sStreamFullName);
         }
         else
         {
             // Read stream
-            tools::SvRef<SotStorageStream> rStream = pStorage->OpenSotStream(aElement.GetName(), StreamMode::READ | StreamMode::SHARE_DENYALL);
+            rtl::Reference<SotStorageStream> rStream = pStorage->OpenSotStream(aElement.GetName(), StreamMode::READ | StreamMode::SHARE_DENYALL);
             if (rStream.is())
             {
                 sal_Int32 nStreamSize = rStream->GetSize();
@@ -81,9 +81,9 @@ static void lcl_getListOfStreams(SotStorage * pStorage, comphelper::SequenceAsHa
     }
 }
 
-static tools::SvRef<SotStorage> lcl_DRMDecrypt(const SfxMedium& rMedium, const tools::SvRef<SotStorage>& rStorage, std::shared_ptr<SvStream>& rNewStorageStrm)
+static rtl::Reference<SotStorage> lcl_DRMDecrypt(const SfxMedium& rMedium, const rtl::Reference<SotStorage>& rStorage, std::shared_ptr<SvStream>& rNewStorageStrm)
 {
-    tools::SvRef<SotStorage> aNewStorage;
+    rtl::Reference<SotStorage> aNewStorage;
 
     // We have DRM encrypted storage. We should try to decrypt it first, if we can
     Sequence< Any > aArguments;
@@ -109,7 +109,7 @@ static tools::SvRef<SotStorage> lcl_DRMDecrypt(const SfxMedium& rMedium, const t
             return aNewStorage;
         }
 
-        tools::SvRef<SotStorageStream> rContentStream = rStorage->OpenSotStream("\011DRMContent", StreamMode::READ | StreamMode::SHARE_DENYALL);
+        rtl::Reference<SotStorageStream> rContentStream = rStorage->OpenSotStream("\011DRMContent", StreamMode::READ | StreamMode::SHARE_DENYALL);
         if (!rContentStream.is())
         {
             return aNewStorage;
@@ -147,12 +147,12 @@ bool SdPPTFilter::Import()
 {
     bool bRet = false;
     std::shared_ptr<SvStream> aDecryptedStorageStrm;
-    tools::SvRef<SotStorage> pStorage = new SotStorage( mrMedium.GetInStream(), false );
+    rtl::Reference<SotStorage> pStorage = new SotStorage(mrMedium.GetInStream(), false);
     if( !pStorage->GetError() )
     {
         /* check if there is a dualstorage, then the
         document is probably a PPT95 containing PPT97 */
-        tools::SvRef<SotStorage> xDualStorage;
+        rtl::Reference<SotStorage> xDualStorage;
         OUString sDualStorage( "PP97_DUALSTORAGE"  );
         if ( pStorage->IsContained( sDualStorage ) )
         {
@@ -164,7 +164,7 @@ bool SdPPTFilter::Import()
             // Document is DRM encrypted
             pStorage = lcl_DRMDecrypt(mrMedium, pStorage, aDecryptedStorageStrm);
         }
-        tools::SvRef<SotStorageStream> pDocStream(pStorage->OpenSotStream( "PowerPoint Document" , StreamMode::STD_READ ));
+        rtl::Reference<SotStorageStream> pDocStream(pStorage->OpenSotStream( "PowerPoint Document" , StreamMode::STD_READ ));
         if( pDocStream )
         {
             pDocStream->SetVersion( pStorage->GetVersion() );
@@ -244,7 +244,7 @@ bool SdPPTFilter::Export()
             }
         }
 
-        tools::SvRef<SotStorage> xStorRef = new SotStorage(pOutputStrm, false);
+        rtl::Reference<SotStorage> xStorRef = new SotStorage(pOutputStrm, false);
 
         if (xStorRef.is())
         {
@@ -261,12 +261,12 @@ bool SdPPTFilter::Export()
                 Reference<css::io::XInputStream > xInputStream(new utl::OSeekableInputStreamWrapper(pOutputStrm, false));
                 Sequence<NamedValue> aStreams = xPackageEncryption->encrypt(xInputStream);
 
-                tools::SvRef<SotStorage> xEncryptedRootStrg = new SotStorage(mrMedium.GetOutStream(), false);
+                rtl::Reference<SotStorage> xEncryptedRootStrg = new SotStorage(mrMedium.GetOutStream(), false);
                 for (const NamedValue& aStreamData : aStreams)
                 {
                     // To avoid long paths split and open substorages recursively
                     // Splitting paths manually, since comphelper::string::split is trimming special characters like \0x01, \0x09
-                    tools::SvRef<SotStorage> pStorage = xEncryptedRootStrg.get();
+                    rtl::Reference<SotStorage> pStorage = xEncryptedRootStrg;
                     OUString sFileName;
                     sal_Int32 idx = 0;
                     do
@@ -291,7 +291,7 @@ bool SdPPTFilter::Export()
                         break;
                     }
 
-                    tools::SvRef<SotStorageStream> pStream = pStorage->OpenSotStream(sFileName);
+                    rtl::Reference<SotStorageStream> pStream = pStorage->OpenSotStream(sFileName);
                     if (!pStream)
                     {
                         bRet = false;
diff --git a/sd/source/ui/app/sdmod.cxx b/sd/source/ui/app/sdmod.cxx
index 22f566706c46..f1b9a9bbe8a1 100644
--- a/sd/source/ui/app/sdmod.cxx
+++ b/sd/source/ui/app/sdmod.cxx
@@ -162,11 +162,11 @@ SdOptions* SdModule::GetSdOptions(DocumentType eDocType)
  * if the stream is opened for reading but does not exist, an 'empty'
  * RefObject is returned
  */
-tools::SvRef<SotStorageStream> SdModule::GetOptionStream( std::u16string_view rOptionName,
+rtl::Reference<SotStorageStream> SdModule::GetOptionStream( std::u16string_view rOptionName,
                                               SdOptionStreamMode eMode )
 {
     ::sd::DrawDocShell*     pDocSh = dynamic_cast< ::sd::DrawDocShell *>( SfxObjectShell::Current() );
-    tools::SvRef<SotStorageStream>  xStm;
+    rtl::Reference<SotStorageStream> xStm;
 
     if( pDocSh )
     {
diff --git a/sd/source/ui/app/sdmod1.cxx b/sd/source/ui/app/sdmod1.cxx
index 66e1ecd8bad8..14f507fb1a1d 100644
--- a/sd/source/ui/app/sdmod1.cxx
+++ b/sd/source/ui/app/sdmod1.cxx
@@ -255,10 +255,9 @@ bool SdModule::OutlineToImpress(SfxRequest const & rRequest)
 
         if (pBytes.getLength())
         {
-            SfxObjectShellLock xDocShell;
-            ::sd::DrawDocShell* pDocSh;
-            xDocShell = pDocSh = new ::sd::DrawDocShell(
+            rtl::Reference<sd::DrawDocShell> pDocSh = new ::sd::DrawDocShell(
                 SfxObjectCreateMode::STANDARD, false, DocumentType::Impress);
+            SfxObjectShellLock xDocShell(pDocSh.get());
 
             pDocSh->DoInitNew();
             SdDrawDocument* pDoc = pDocSh->GetDoc();
@@ -518,9 +517,8 @@ SfxFrame* SdModule::CreateEmptyDocument( const Reference< XFrame >& i_rFrame )
 {
     SfxFrame* pFrame = nullptr;
 
-    SfxObjectShellLock xDocShell;
-    ::sd::DrawDocShell* pNewDocSh;
-    xDocShell = pNewDocSh = new ::sd::DrawDocShell(SfxObjectCreateMode::STANDARD,false,DocumentType::Impress);
+    rtl::Reference<sd::DrawDocShell> pNewDocSh = new ::sd::DrawDocShell(SfxObjectCreateMode::STANDARD,false,DocumentType::Impress);
+    SfxObjectShellLock xDocShell(pNewDocSh.get());
     pNewDocSh->DoInitNew();
     SdDrawDocument* pDoc = pNewDocSh->GetDoc();
     if (pDoc)
diff --git a/sd/source/ui/dlg/morphdlg.cxx b/sd/source/ui/dlg/morphdlg.cxx
index c0d7f4e5af20..96ed63f0b52d 100644
--- a/sd/source/ui/dlg/morphdlg.cxx
+++ b/sd/source/ui/dlg/morphdlg.cxx
@@ -65,7 +65,7 @@ MorphDlg::~MorphDlg()
 
 void MorphDlg::LoadSettings()
 {
-    tools::SvRef<SotStorageStream>  xIStm( SD_MOD()->GetOptionStream( SD_OPTION_MORPHING ,
+    rtl::Reference<SotStorageStream>  xIStm( SD_MOD()->GetOptionStream( SD_OPTION_MORPHING ,
                                SdOptionStreamMode::Load ) );
     sal_uInt16              nSteps;
     bool                bOrient, bAttrib;
@@ -89,7 +89,7 @@ void MorphDlg::LoadSettings()
 
 void MorphDlg::SaveSettings() const
 {
-    tools::SvRef<SotStorageStream> xOStm( SD_MOD()->GetOptionStream( SD_OPTION_MORPHING ,
+    rtl::Reference<SotStorageStream> xOStm( SD_MOD()->GetOptionStream( SD_OPTION_MORPHING ,
                                SdOptionStreamMode::Store ) );
 
     if( xOStm.is() )
diff --git a/sd/source/ui/dlg/vectdlg.cxx b/sd/source/ui/dlg/vectdlg.cxx
index de555ceedb05..92961bb432a9 100644
--- a/sd/source/ui/dlg/vectdlg.cxx
+++ b/sd/source/ui/dlg/vectdlg.cxx
@@ -290,7 +290,7 @@ IMPL_LINK_NOARG(SdVectorizeDlg, MetricModifyHdl, weld::MetricSpinButton&, void)
 
 void SdVectorizeDlg::LoadSettings()
 {
-    tools::SvRef<SotStorageStream>  xIStm( SD_MOD()->GetOptionStream(
+    rtl::Reference<SotStorageStream>  xIStm( SD_MOD()->GetOptionStream(
                                SD_OPTION_VECTORIZE ,
                                SdOptionStreamMode::Load ) );
     sal_uInt16              nLayers;
@@ -321,7 +321,7 @@ void SdVectorizeDlg::LoadSettings()
 
 void SdVectorizeDlg::SaveSettings() const
 {
-    tools::SvRef<SotStorageStream> xOStm( SD_MOD()->GetOptionStream(
+    rtl::Reference<SotStorageStream> xOStm( SD_MOD()->GetOptionStream(
                               SD_OPTION_VECTORIZE  ,
                               SdOptionStreamMode::Store ) );
 
diff --git a/sd/source/ui/inc/DrawDocShell.hxx b/sd/source/ui/inc/DrawDocShell.hxx
index b53debc7dcbe..2ae1a106d7c2 100644
--- a/sd/source/ui/inc/DrawDocShell.hxx
+++ b/sd/source/ui/inc/DrawDocShell.hxx
@@ -23,6 +23,7 @@
 
 #include <span>
 
+#include <rtl/ref.hxx>
 #include <sfx2/docfac.hxx>
 #include <sfx2/objsh.hxx>
 #include <svl/style.hxx>
@@ -228,7 +229,7 @@ private:
 
 #ifndef SV_DECL_DRAW_DOC_SHELL_DEFINED
 #define SV_DECL_DRAW_DOC_SHELL_DEFINED
-typedef ::tools::SvRef<DrawDocShell> DrawDocShellRef;
+typedef rtl::Reference<DrawDocShell> DrawDocShellRef;
 #endif
 
 } // end of namespace sd
diff --git a/sd/source/ui/inc/sdtreelb.hxx b/sd/source/ui/inc/sdtreelb.hxx
index 4ee9cdf0507d..bb09653db584 100644
--- a/sd/source/ui/inc/sdtreelb.hxx
+++ b/sd/source/ui/inc/sdtreelb.hxx
@@ -44,7 +44,7 @@ class ViewShell;
 class DrawDocShell;
 #ifndef SV_DECL_DRAW_DOC_SHELL_DEFINED
 #define SV_DECL_DRAW_DOC_SHELL_DEFINED
-typedef ::tools::SvRef<DrawDocShell> DrawDocShellRef;
+typedef rtl::Reference<DrawDocShell> DrawDocShellRef;
 #endif
 }
 namespace svt {
diff --git a/sd/source/ui/unoidl/sddetect.cxx b/sd/source/ui/unoidl/sddetect.cxx
index cfa50d14188a..b3f3dabff605 100644
--- a/sd/source/ui/unoidl/sddetect.cxx
+++ b/sd/source/ui/unoidl/sddetect.cxx
@@ -76,7 +76,7 @@ OUString SAL_CALL SdFilterDetect::detect( Sequence< beans::PropertyValue >& lDes
 
         try
         {
-            tools::SvRef<SotStorage> aStorage = new SotStorage( pInStrm, false );
+            rtl::Reference<SotStorage> aStorage = new SotStorage(pInStrm, false);
             if ( !aStorage->GetError() && aStorage->IsStream( "PowerPoint Document" ) )
                 return aTypeName;
         }
diff --git a/sd/source/ui/unoidl/unodoc.cxx b/sd/source/ui/unoidl/unodoc.cxx
index cfb97c186cdb..b19e31f674f1 100644
--- a/sd/source/ui/unoidl/unodoc.cxx
+++ b/sd/source/ui/unoidl/unodoc.cxx
@@ -40,7 +40,7 @@ sd_DrawingDocument_get_implementation(
     css::uno::Reference<css::uno::XInterface> xInterface = sfx2::createSfxModelInstance(args,
         [](SfxModelFlags _nCreationFlags)
         {
-            SfxObjectShell* pShell = new ::sd::GraphicDocShell( _nCreationFlags );
+            rtl::Reference<SfxObjectShell> pShell = new ::sd::GraphicDocShell(_nCreationFlags);
             return uno::Reference< uno::XInterface >( pShell->GetModel() );
         });
     xInterface->acquire();
@@ -61,7 +61,7 @@ sd_PresentationDocument_get_implementation(
     css::uno::Reference<css::uno::XInterface> xInterface = sfx2::createSfxModelInstance(args,
         [](SfxModelFlags _nCreationFlags)
         {
-            SfxObjectShell* pShell =
+            rtl::Reference<SfxObjectShell> pShell =
                 new ::sd::DrawDocShell(
                     _nCreationFlags, false, DocumentType::Impress );
             return pShell->GetModel();