diff options
author | Michael Stahl <mstahl@redhat.com> | 2014-08-17 22:58:49 +0200 |
---|---|---|
committer | Michael Stahl <mstahl@redhat.com> | 2014-08-20 16:40:13 +0200 |
commit | 7a3716bd7b90587974b50455c927bc330c2a6a63 (patch) | |
tree | b0a9740e8ca04e8201f2a43f316dcd7a2bb324b9 | |
parent | 7fa2a363332620de869c67b8c9cca72cd093f2c4 (diff) |
fdo#72695: avoid double-free race condition for SwXTextSection
Change-Id: I6a4cd076deef63f172c42dcc22cc44c47a4aa293
-rw-r--r-- | sw/source/core/unocore/unosect.cxx | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/sw/source/core/unocore/unosect.cxx b/sw/source/core/unocore/unosect.cxx index f88fee01ee41..8f67eb8c2a91 100644 --- a/sw/source/core/unocore/unosect.cxx +++ b/sw/source/core/unocore/unosect.cxx @@ -108,6 +108,7 @@ private: public: SwXTextSection & m_rThis; + uno::WeakReference<uno::XInterface> m_wThis; const SfxItemPropertySet & m_rPropSet; ::cppu::OInterfaceContainerHelper m_EventListeners; const bool m_bIndexHeader; @@ -163,11 +164,18 @@ protected: void SwXTextSection::Impl::Modify( const SfxPoolItem *pOld, const SfxPoolItem *pNew) { ClientModify(this, pOld, pNew); - if (!GetRegisteredIn()) + if (GetRegisteredIn()) { - lang::EventObject const ev(static_cast< ::cppu::OWeakObject&>(m_rThis)); - m_EventListeners.disposeAndClear(ev); + return; // core object still alive } + + uno::Reference<uno::XInterface> const xThis(m_wThis); + if (!xThis.is()) + { // fdo#72695: if UNO object is already dead, don't revive it with event + return; + } + lang::EventObject const ev(xThis); + m_EventListeners.disposeAndClear(ev); } SwSectionFmt * SwXTextSection::GetFmt() const @@ -194,6 +202,8 @@ SwXTextSection::CreateXTextSection( { pFmt->SetXTextSection(xSection); } + // need a permanent Reference to initialize m_wThis + pNew->m_pImpl->m_wThis = xSection; } return xSection; } |