diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2019-06-25 14:00:20 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2019-06-25 21:10:27 +0200 |
| commit | a4f67bce94b080062edf8cd5ba7113d5e384d63d (patch) | |
| tree | b164be58ddbbb5e353cd0f1a130ed536a6fb8fe5 /vcl | |
| parent | 069033a6ef8902e84df9f8c90c501c7319f37a4e (diff) | |
tdf#126054 uses after free when menubutton and menu torn down during execution
Change-Id: Ib79da121941863421bc12afa27e27cdd7e2e81e3
Reviewed-on: https://gerrit.libreoffice.org/74697
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'vcl')
| -rw-r--r-- | vcl/source/control/menubtn.cxx | 4 | ||||
| -rw-r--r-- | vcl/source/window/menu.cxx | 3 |
2 files changed, 7 insertions, 0 deletions
diff --git a/vcl/source/control/menubtn.cxx b/vcl/source/control/menubtn.cxx index c6f6123c1a92..ccf336a46375 100644 --- a/vcl/source/control/menubtn.cxx +++ b/vcl/source/control/menubtn.cxx @@ -51,6 +51,10 @@ void MenuButton::ExecuteMenu() Point aPos(0, 1); tools::Rectangle aRect(aPos, aSize ); mpMenu->Execute(this, aRect, PopupMenuFlags::ExecuteDown); + + if (IsDisposed()) + return; + mnCurItemId = mpMenu->GetCurItemId(); msCurItemIdent = mpMenu->GetCurItemIdent(); } diff --git a/vcl/source/window/menu.cxx b/vcl/source/window/menu.cxx index 5b56a929aaeb..2385f432c666 100644 --- a/vcl/source/window/menu.cxx +++ b/vcl/source/window/menu.cxx @@ -2966,6 +2966,9 @@ sal_uInt16 PopupMenu::ImplExecute( const VclPtr<vcl::Window>& pW, const tools::R aSz.setHeight( ImplCalcHeight( nEntries ) ); } + // tdf#126054 hold this until after function completes + VclPtr<PopupMenu> m_xThis(this); + pWin->SetFocusId( xFocusId ); pWin->SetOutputSizePixel( aSz ); if ( GetItemCount() ) |