From 7cbd6d768d282077053c354254315f3dc89bf254 Mon Sep 17 00:00:00 2001
From: Michael Stahl <michael.stahl@allotropia.de>
Date: Wed, 30 Jun 2021 13:26:59 +0200
Subject: sfx2: try to fix lifecycle of SfxOfficeDispatch

This can be created either from the global SfxApplication, or from a
SfxViewFrame.

Particularly in the latter case, the SfxDispatcher and SfxBindings
members are owned by SfxViewFrame, so in case that is destroyed, the
SfxOfficeDispatch must clear its pointers.

It looks like the member pointers are checked before access already
everywhere, so just listen at the SfxViewFrame.

Change-Id: If08825734e94dd54e32cb77546684fd583c336ec
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118162
Tested-by: Michael Stahl <michael.stahl@allotropia.de>
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
---
 framework/qa/cppunit/data/empty.fodp  |  2 ++
 framework/qa/cppunit/dispatchtest.cxx | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 framework/qa/cppunit/data/empty.fodp

(limited to 'framework')

diff --git a/framework/qa/cppunit/data/empty.fodp b/framework/qa/cppunit/data/empty.fodp
new file mode 100644
index 000000000000..3c2a4cf2cda5
--- /dev/null
+++ b/framework/qa/cppunit/data/empty.fodp
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.presentation"><office:body><office:presentation><draw:page/></office:presentation></office:body></office:document>
diff --git a/framework/qa/cppunit/dispatchtest.cxx b/framework/qa/cppunit/dispatchtest.cxx
index 586c4af3b9b0..2f21a71b005e 100644
--- a/framework/qa/cppunit/dispatchtest.cxx
+++ b/framework/qa/cppunit/dispatchtest.cxx
@@ -15,6 +15,7 @@
 #include <com/sun/star/frame/DispatchHelper.hpp>
 #include <com/sun/star/frame/XDispatchProviderInterceptor.hpp>
 #include <com/sun/star/frame/XInterceptorInfo.hpp>
+#include <com/sun/star/util/URLTransformer.hpp>
 
 #include <comphelper/processfactory.hxx>
 #include <rtl/ref.hxx>
@@ -199,6 +200,37 @@ CPPUNIT_TEST_FIXTURE(DispatchTest, testInterception)
     // This was 1: MyInterceptor::queryDispatch() was called for .uno:Italic.
     CPPUNIT_ASSERT_EQUAL(0, pInterceptor->getUnexpected());
 }
+
+constexpr OUStringLiteral DATA_DIRECTORY = u"/framework/qa/cppunit/data/";
+
+CPPUNIT_TEST_FIXTURE(DispatchTest, testSfxOfficeDispatchDispose)
+{
+    // this test doesn't work with a new document because of aURL.Main check in SfxBaseController::dispatch()
+    mxComponent = loadFromDesktop(m_directories.getURLFromSrc(DATA_DIRECTORY) + "empty.fodp",
+                                  "com.sun.star.presentation.PresentationDocument");
+    uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
+    CPPUNIT_ASSERT(xModel.is());
+    uno::Reference<frame::XController> xController(xModel->getCurrentController());
+    CPPUNIT_ASSERT(xController.is());
+    uno::Reference<frame::XDispatchProvider> xFrame(xController->getFrame(), uno::UNO_QUERY);
+    CPPUNIT_ASSERT(xFrame.is());
+
+    uno::Reference<util::XURLTransformer> xParser(util::URLTransformer::create(mxComponentContext));
+    util::URL url;
+    url.Complete = xModel->getURL() + "#dummy";
+    xParser->parseStrict(url);
+
+    uno::Reference<frame::XDispatch> xDisp(xFrame->queryDispatch(url, "", 0));
+    CPPUNIT_ASSERT(xDisp.is());
+
+    mxComponent->dispose();
+
+    util::URL urlSlot;
+    urlSlot.Complete = "slot:5598";
+    xParser->parseStrict(urlSlot);
+    // crashed with UAF
+    xDisp->dispatch(urlSlot, {});
+}
 }
 
 CPPUNIT_PLUGIN_IMPLEMENT();
-- 
cgit