diff options
| -rw-r--r-- | sc/source/ui/Accessibility/AccessibleDocument.cxx | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/sc/source/ui/Accessibility/AccessibleDocument.cxx b/sc/source/ui/Accessibility/AccessibleDocument.cxx index d6ccb9ea32cc..cac634524832 100644 --- a/sc/source/ui/Accessibility/AccessibleDocument.cxx +++ b/sc/source/ui/Accessibility/AccessibleDocument.cxx @@ -1493,9 +1493,15 @@ void ScAccessibleDocument::Notify( SfxBroadcaster& rBC, const SfxHint& rHint ) if (mxTempAcc.is()) { if (mpTempAccEdit) + { mpTempAccEdit->LostFocus(); - - mpTempAccEdit = nullptr; + // tdf#125982 a11y use-after-free of editengine by + // ScAccessibleEditObjectTextData living past the + // the editengine of the editview passed in above + // in ScAccEnterEditMode + mpTempAccEdit->dispose(); + mpTempAccEdit = nullptr; + } RemoveChild(mxTempAcc, true); if (mpAccessibleSpreadsheet.is() && mpViewShell && mpViewShell->IsActive()) mpAccessibleSpreadsheet->GotFocus(); |