ofz#50767 docxfuzzer: Indirect-leak in rtl_allocateMemory

Two fixes required here

(1) the unnecessary use of aggregation in SwXDrawPage, which leads to a
very confusing cycle that I don't fully follow. No indication why this
is necessary in the git history, has been this way since initial commit

(2) a ref-counting cycle through SvxShapeGroup and SvxDrawPage, use a
weak reference here to break the ref-counting cycle.

Change-Id: Ie7ec583960ed0864a073ad8489fb65964bd83080
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/139828
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>

1 files changed, 13 insertions, 7 deletions

diff --git a/svx/source/unodraw/unoshap2.cxx b/svx/source/unodraw/unoshap2.cxx
index cf72530e6c7d..0315d2a5c74e 100644
--- a/svx/source/unodraw/unoshap2.cxx
+++ b/svx/source/unodraw/unoshap2.cxx
@@ -80,7 +80,7 @@ using namespace ::com::sun::star::container;
 
 SvxShapeGroup::SvxShapeGroup(SdrObject* pObj, SvxDrawPage* pDrawPage)
     : SvxShapeGroupAnyD(pObj, getSvxMapProvider().GetMap(SVXMAP_GROUP), getSvxMapProvider().GetPropertySet(SVXMAP_GROUP, SdrObject::GetGlobalDrawObjectItemPool()))
-    , mxPage(pDrawPage)
+    , mxWeakPage(pDrawPage)
 {
 }
 
@@ -91,7 +91,7 @@ SvxShapeGroup::~SvxShapeGroup() noexcept
 void SvxShapeGroup::Create( SdrObject* pNewObj, SvxDrawPage* pNewPage )
 {
     SvxShape::Create( pNewObj, pNewPage );
-    mxPage = pNewPage;
+    mxWeakPage = pNewPage;
 }
 
 
@@ -185,7 +185,13 @@ void SvxShapeGroup::addShape( SvxShape& rShape )
 
 void SvxShapeGroup::addShape( SvxShape& rShape, size_t nPos )
 {
-    if (!HasSdrObject() || !mxPage.is())
+    SdrObject* pSdrObject = GetSdrObject();
+    if (!pSdrObject)
+    {
+        return;
+    }
+    rtl::Reference<SvxDrawPage> xPage = mxWeakPage.get();
+    if (!xPage)
     {
         OSL_FAIL("could not add XShape to group shape!");
         return;
@@ -193,12 +199,12 @@ void SvxShapeGroup::addShape( SvxShape& rShape, size_t nPos )
 
     rtl::Reference<SdrObject> pSdrShape = rShape.GetSdrObject();
     if( pSdrShape == nullptr )
-        pSdrShape = mxPage->CreateSdrObject_( &rShape );
+        pSdrShape = xPage->CreateSdrObject_( &rShape );
 
     if( pSdrShape->IsInserted() )
         pSdrShape->getParentSdrObjListFromSdrObject()->RemoveObject( pSdrShape->GetOrdNum() );
 
-    GetSdrObject()->GetSubList()->InsertObject(pSdrShape.get(), nPos);
+    pSdrObject->GetSubList()->InsertObject(pSdrShape.get(), nPos);
     // TTTT Was created using mpModel in CreateSdrObject_ above
     // TTTT may be good to add an assertion here for the future
     // pSdrShape->SetModel(GetSdrObject()->GetModel());
@@ -214,9 +220,9 @@ void SvxShapeGroup::addShape( SvxShape& rShape, size_t nPos )
     // Establish connection between new SdrObject and its wrapper before
     // inserting the new shape into the group.  There a new wrapper
     // would be created when this connection would not already exist.
-    rShape.Create( pSdrShape.get(), mxPage.get() );
+    rShape.Create( pSdrShape.get(), xPage.get() );
 
-    GetSdrObject()->getSdrModelFromSdrObject().SetChanged();
+    pSdrObject->getSdrModelFromSdrObject().SetChanged();
 }
 
 // XShapes