From 08640f4c2eb1e008cf51300299cbc41f1a3d5b7f Mon Sep 17 00:00:00 2001
From: Noel Grandin <noel.grandin@collabora.co.uk>
Date: Thu, 17 Jun 2021 13:38:07 +0200
Subject: fix potential write-after-free in RecentDocsView

spotted while running a valgrind session

Change-Id: I32c55ae2cc4b2d5abedca24c2f747aaa4183b3d7
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/117382
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
(cherry picked from commit 2176084192dc46a1ef5d6dd79effa5cd5d1dcca2)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/118256
---
 sfx2/inc/recentdocsview.hxx            | 4 +++-
 sfx2/source/control/recentdocsview.cxx | 8 ++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

(limited to 'sfx2')

diff --git a/sfx2/inc/recentdocsview.hxx b/sfx2/inc/recentdocsview.hxx
index c8db9bc3c043..a6e2f86a155a 100644
--- a/sfx2/inc/recentdocsview.hxx
+++ b/sfx2/inc/recentdocsview.hxx
@@ -17,6 +17,7 @@
 #include <com/sun/star/util/URL.hpp>
 #include <com/sun/star/beans/PropertyValue.hpp>
 
+struct ImplSVEvent;
 namespace com::sun::star::frame { class XDispatch; }
 
 namespace sfx2
@@ -92,7 +93,7 @@ private:
 
     bool isAcceptedFile(const OUString &rURL) const;
 
-    DECL_STATIC_LINK( RecentDocsView, ExecuteHdl_Impl, void*, void );
+    DECL_LINK( ExecuteHdl_Impl, void*, void );
 
     tools::Long mnItemMaxSize;
     size_t mnLastMouseDownItem;
@@ -103,6 +104,7 @@ private:
     OUString maWelcomeLine2;
 
     sfx2::LoadRecentFile* mpLoadRecentFile;
+    ImplSVEvent* m_nExecuteHdlId;
 };
 
 } // namespace sfx2
diff --git a/sfx2/source/control/recentdocsview.cxx b/sfx2/source/control/recentdocsview.cxx
index 958785a12394..e74c354bef92 100644
--- a/sfx2/source/control/recentdocsview.cxx
+++ b/sfx2/source/control/recentdocsview.cxx
@@ -130,6 +130,7 @@ RecentDocsView::RecentDocsView(std::unique_ptr<weld::ScrolledWindow> xWindow, st
     , maWelcomeLine1(SfxResId(STR_WELCOME_LINE1))
     , maWelcomeLine2(SfxResId(STR_WELCOME_LINE2))
     , mpLoadRecentFile(nullptr)
+    , m_nExecuteHdlId(nullptr)
 {
     tools::Rectangle aScreen = Application::GetScreenPosSizePixel(Application::GetDisplayBuiltInScreen());
     mnItemMaxSize = std::min(aScreen.GetWidth(),aScreen.GetHeight()) > 800 ? 256 : 192;
@@ -148,6 +149,8 @@ RecentDocsView::RecentDocsView(std::unique_ptr<weld::ScrolledWindow> xWindow, st
 
 RecentDocsView::~RecentDocsView()
 {
+    Application::RemoveUserEvent(m_nExecuteHdlId);
+    m_nExecuteHdlId = nullptr;
     if (mpLoadRecentFile)
     {
         mpLoadRecentFile->pView = nullptr;
@@ -401,7 +404,7 @@ void RecentDocsView::PostLoadRecentUsedFile(LoadRecentFile* pLoadRecentFile)
 {
     assert(!mpLoadRecentFile);
     mpLoadRecentFile = pLoadRecentFile;
-    Application::PostUserEvent(LINK(nullptr, RecentDocsView, ExecuteHdl_Impl), pLoadRecentFile);
+    m_nExecuteHdlId = Application::PostUserEvent(LINK(this, RecentDocsView, ExecuteHdl_Impl), pLoadRecentFile);
 }
 
 void RecentDocsView::DispatchedLoadRecentUsedFile()
@@ -409,8 +412,9 @@ void RecentDocsView::DispatchedLoadRecentUsedFile()
     mpLoadRecentFile = nullptr;
 }
 
-IMPL_STATIC_LINK( RecentDocsView, ExecuteHdl_Impl, void*, p, void )
+IMPL_LINK( RecentDocsView, ExecuteHdl_Impl, void*, p, void )
 {
+    m_nExecuteHdlId = nullptr;
     LoadRecentFile* pLoadRecentFile = static_cast<LoadRecentFile*>(p);
     try
     {
-- 
cgit