Fix "AddressSanitizer: heap-use-after-free"cp-23.05.0-1

https://github.com/CollaboraOnline/online/issues/6380

Commit 7481e8b5500e86626be5f8eae1e7f48b7f51e21a (sw_redlinehide_4a:
SwEditShell::AutoCorrect() etc., 2018-11-28) explicitly relied upon
the reference to the node text being updated on editing operations.

Commit 14f6700fefa945c4cf995c09af9326c2a022f886 (use more string_view
in editeng, 2022-04-14) converted the argument of FnChgToEnEmDash to
a string view, which means that any change in the underlying OUString
frees the memory referenced by the view.

But in this method, we really don't want to have the text updated;
so use a local OUString copy for later reference.

Partially revert commit 14f6700fefa945c4cf995c09af9326c2a022f886.

And copy mst's commit 7481e8b5500e86626be5f8eae1e7f48b7f51e21a
message to document the assumptions in SwEditShell::AutoCorrect.

Change-Id: I0ff02958c8de9566d774f366d905aa9bb603055c
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151970
Tested-by: Mike Kaganski <mike.kaganski@collabora.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit 0350d502a68166e700d3e329340d8e79c4b159a8)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151917
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Andras Timar <andras.timar@collabora.com>

3 files changed, 13 insertions, 5 deletions

diff --git a/editeng/source/misc/svxacorr.cxx b/editeng/source/misc/svxacorr.cxx
index 5e229ba10d24..1ae3ed49dfd4 100644
--- a/editeng/source/misc/svxacorr.cxx
+++ b/editeng/source/misc/svxacorr.cxx
@@ -544,7 +544,7 @@ bool SvxAutoCorrect::FnChgOrdinalNumber(
 
 // Replace dashes
 bool SvxAutoCorrect::FnChgToEnEmDash(
-                                SvxAutoCorrDoc& rDoc, std::u16string_view rTxt,
+                                SvxAutoCorrDoc& rDoc, const OUString& rTxt,
                                 sal_Int32 nSttPos, sal_Int32 nEndPos,
                                 LanguageType eLang )
 {
@@ -554,6 +554,10 @@ bool SvxAutoCorrect::FnChgToEnEmDash(
         eLang = GetAppLang().getLanguageType();
     bool bAlwaysUseEmDash = (eLang == LANGUAGE_RUSSIAN || eLang == LANGUAGE_UKRAINIAN);
 
+    // rTxt may refer to the frame text that will change in the calls to rDoc.Delete / rDoc.Insert;
+    // keep a local copy for later use
+    OUString aOrigTxt = rTxt;
+
     // replace " - " or " --" with "enDash"
     if( 1 < nSttPos && 1 <= nEndPos - nSttPos )
     {
@@ -630,14 +634,14 @@ bool SvxAutoCorrect::FnChgToEnEmDash(
     bool bEnDash = (eLang == LANGUAGE_HUNGARIAN || eLang == LANGUAGE_FINNISH);
     if( 4 <= nEndPos - nSttPos )
     {
-        OUString sTmp( rTxt.substr( nSttPos, nEndPos - nSttPos ) );
+        OUString sTmp( aOrigTxt.subView( nSttPos, nEndPos - nSttPos ) );
         sal_Int32 nFndPos = sTmp.indexOf("--");
         if( nFndPos != -1 && nFndPos &&
             nFndPos + 2 < sTmp.getLength() &&
             ( rCC.isLetterNumeric( sTmp, nFndPos - 1 ) ||
-              lcl_IsInAsciiArr( sImplEndSkipChars, rTxt[ nFndPos - 1 ] )) &&
+              lcl_IsInAsciiArr( sImplEndSkipChars, aOrigTxt[ nFndPos - 1 ] )) &&
             ( rCC.isLetterNumeric( sTmp, nFndPos + 2 ) ||
-            lcl_IsInAsciiArr( sImplSttSkipChars, rTxt[ nFndPos + 2 ] )))
+            lcl_IsInAsciiArr( sImplSttSkipChars, aOrigTxt[ nFndPos + 2 ] )))
         {
             nSttPos = nSttPos + nFndPos;
             rDoc.Delete( nSttPos, nSttPos + 2 );
diff --git a/include/editeng/svxacorr.hxx b/include/editeng/svxacorr.hxx
index 39a3d4c65f81..f71af87bc5b8 100644
--- a/include/editeng/svxacorr.hxx
+++ b/include/editeng/svxacorr.hxx
@@ -407,7 +407,7 @@ public:
     bool FnChgOrdinalNumber( SvxAutoCorrDoc&, const OUString&,
                                 sal_Int32 nSttPos, sal_Int32 nEndPos,
                                 LanguageType eLang );
-    bool FnChgToEnEmDash( SvxAutoCorrDoc&, std::u16string_view,
+    bool FnChgToEnEmDash( SvxAutoCorrDoc&, const OUString&,
                                 sal_Int32 nSttPos, sal_Int32 nEndPos,
                                 LanguageType eLang );
     bool FnAddNonBrkSpace( SvxAutoCorrDoc&, std::u16string_view,
diff --git a/sw/source/core/edit/edws.cxx b/sw/source/core/edit/edws.cxx
index abbb920afdc5..4e46ae2daf5a 100644
--- a/sw/source/core/edit/edws.cxx
+++ b/sw/source/core/edit/edws.cxx
@@ -272,6 +272,10 @@ void SwEditShell::AutoCorrect( SvxAutoCorrect& rACorr, bool bInsert,
     // something - so first normalize cursor point to end of redline so that
     // point will then be moved forward when something is inserted.
     *pCursor->GetPoint() = pFrame->MapViewToModelPos(nPos);
+    // The hope is that the AutoCorrect never deletes nodes, hence never
+    // deletes SwTextFrames, hence we can pass in the SwTextFrame::GetText()
+    // result and it will be updated via the SwTextFrame::SwClientNotify()
+    // on editing operations.
     OUString const& rMergedText(pFrame->GetText());
     rACorr.DoAutoCorrect( aSwAutoCorrDoc,
                     rMergedText, sal_Int32(nPos),