From 1ac5353bbb25bd9ff0ab0e157b3dbd0da325480a Mon Sep 17 00:00:00 2001
From: Mike Kaganski <mike.kaganski@collabora.com>
Date: Wed, 6 Mar 2024 16:06:40 +0600
Subject: Use weak reference to SfxObjectShell in SfxEventHint to avoid
 use-after-free

The events may be processed after the shell has been destroyed. This is
happening reliably after commit e2bfc34d146806a8f96be0cd2323d716f12cba4e
(Reimplement OleComponentNative_Impl to use IGlobalInterfaceTable,
2024-03-11) when controlling LibreOffice from external Java scripts; but
obviously, it could happen before as well.

Now SotObject inherits from cppu::OWeakObject, instead of SvRefBase.

Change-Id: I73a3531499a3068c801c98f40de39bdf8ad90b2b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164458
Tested-by: Mike Kaganski <mike.kaganski@collabora.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
---
 sd/inc/drawdoc.hxx  | 2 +-
 sd/inc/sdfilter.hxx | 4 ++--
 sd/inc/sdmod.hxx    | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'sd/inc')

diff --git a/sd/inc/drawdoc.hxx b/sd/inc/drawdoc.hxx
index 401bde6b5f88..f2a28131f888 100644
--- a/sd/inc/drawdoc.hxx
+++ b/sd/inc/drawdoc.hxx
@@ -68,7 +68,7 @@ namespace sd
 class DrawDocShell;
 #ifndef SV_DECL_DRAW_DOC_SHELL_DEFINED
 #define SV_DECL_DRAW_DOC_SHELL_DEFINED
-typedef ::tools::SvRef<DrawDocShell> DrawDocShellRef;
+typedef rtl::Reference<DrawDocShell> DrawDocShellRef;
 #endif
 class UndoManager;
 class ShapeList;
diff --git a/sd/inc/sdfilter.hxx b/sd/inc/sdfilter.hxx
index 1a8c8b6739a6..ef3fb7763210 100644
--- a/sd/inc/sdfilter.hxx
+++ b/sd/inc/sdfilter.hxx
@@ -20,8 +20,8 @@
 #pragma once
 
 #include <osl/module.h>
+#include <rtl/ref.hxx>
 #include <rtl/ustring.hxx>
-#include <tools/ref.hxx>
 #include <com/sun/star/beans/PropertyValue.hpp>
 #include <com/sun/star/frame/XModel.hpp>
 #include <com/sun/star/task/XStatusIndicator.hpp>
@@ -57,7 +57,7 @@ protected:
 };
 
 SD_DLLPUBLIC bool ExportPPT( const std::vector< css::beans::PropertyValue >& rMediaData,
-                    tools::SvRef<SotStorage> const & rSvStorage,
+                    rtl::Reference<SotStorage> const & rSvStorage,
                     css::uno::Reference< css::frame::XModel > const & rXModel,
                     css::uno::Reference< css::task::XStatusIndicator > const & rXStatInd,
                     SvMemoryStream* pVBA,
diff --git a/sd/inc/sdmod.hxx b/sd/inc/sdmod.hxx
index e1a2c51b6446..5008fc001f0b 100644
--- a/sd/inc/sdmod.hxx
+++ b/sd/inc/sdmod.hxx
@@ -104,7 +104,7 @@ public:
     void                    GetState(SfxItemSet&);
 
     SdOptions*              GetSdOptions(DocumentType eDocType);
-    SD_DLLPUBLIC tools::SvRef<SotStorageStream>     GetOptionStream( std::u16string_view rOptionName, SdOptionStreamMode eMode );
+    SD_DLLPUBLIC rtl::Reference<SotStorageStream> GetOptionStream( std::u16string_view rOptionName, SdOptionStreamMode eMode );
 
     bool                    GetWaterCan() const { return bWaterCan; }
     void                    SetWaterCan( bool bWC ) { bWaterCan = bWC; }
@@ -140,7 +140,7 @@ private:
     SdOptions*              pDrawOptions;
     std::unique_ptr<SvxSearchItem>      pSearchItem;
     std::unique_ptr<SvNumberFormatter>  pNumberFormatter;
-    tools::SvRef<SotStorage>            xOptionStorage;
+    rtl::Reference<SotStorage>          xOptionStorage;
     bool                    bWaterCan;
     std::unique_ptr<SfxErrorHandler> mpErrorHdl;
     /** This device is used for printer independent layout.  It is virtual
-- 
cgit