From 1ac5353bbb25bd9ff0ab0e157b3dbd0da325480a Mon Sep 17 00:00:00 2001 From: Mike Kaganski Date: Wed, 6 Mar 2024 16:06:40 +0600 Subject: Use weak reference to SfxObjectShell in SfxEventHint to avoid use-after-free The events may be processed after the shell has been destroyed. This is happening reliably after commit e2bfc34d146806a8f96be0cd2323d716f12cba4e (Reimplement OleComponentNative_Impl to use IGlobalInterfaceTable, 2024-03-11) when controlling LibreOffice from external Java scripts; but obviously, it could happen before as well. Now SotObject inherits from cppu::OWeakObject, instead of SvRefBase. Change-Id: I73a3531499a3068c801c98f40de39bdf8ad90b2b Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164458 Tested-by: Mike Kaganski Reviewed-by: Mike Kaganski --- sd/source/filter/eppt/epptso.cxx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sd/source/filter/eppt/epptso.cxx') diff --git a/sd/source/filter/eppt/epptso.cxx b/sd/source/filter/eppt/epptso.cxx index e6923533c92d..97a0f170edf0 100644 --- a/sd/source/filter/eppt/epptso.cxx +++ b/sd/source/filter/eppt/epptso.cxx @@ -1981,14 +1981,14 @@ void PPTWriter::ImplWritePage( const PHLayout& rLayout, EscherSolverContainer& a css::awt::Size aSize; OUString aControlName; - tools::SvRef xTemp( new SotStorage( new SvMemoryStream(), true ) ); + rtl::Reference xTemp(new SotStorage(new SvMemoryStream(), true)); if ( oox::ole::MSConvertOCXControls::WriteOCXStream( mXModel, xTemp, aXControlModel, aSize, aControlName ) ) { OUString aUserName( xTemp->GetUserName() ); OUString aOleIdentifier; if ( !aUserName.isEmpty() ) { - tools::SvRef xCompObj = xTemp->OpenSotStream( + rtl::Reference xCompObj = xTemp->OpenSotStream( "\1CompObj", StreamMode::READ | StreamMode::NOCREATE | StreamMode::SHARE_DENYALL ); sal_uInt32 const nStreamLen = xCompObj->remainingSize(); -- cgit