tdf#107976 sw: let a view handle multiple transferables

Otherwise only the last transferable gets unregistered on closing the
view, which means a use-after-free when trying to paste something copied
from a closed document.

Change-Id: I65594e07fa4fefe7ae51a12455b755d64700a00d
Reviewed-on: https://gerrit.libreoffice.org/38088
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Jenkins <ci@libreoffice.org>

3 files changed, 31 insertions, 10 deletions

diff --git a/sw/qa/extras/uiwriter/uiwriter.cxx b/sw/qa/extras/uiwriter/uiwriter.cxx
index 1e482e1ac87d..60ad0c17719b 100644
--- a/sw/qa/extras/uiwriter/uiwriter.cxx
+++ b/sw/qa/extras/uiwriter/uiwriter.cxx
@@ -94,6 +94,7 @@
 #include <txttypes.hxx>
 #include <SwPortionHandler.hxx>
 #include <hyp.hxx>
+#include <swdtflvr.hxx>
 #include <editeng/svxenum.hxx>
 #include <comphelper/propertysequence.hxx>
 #include <sfx2/classificationhelper.hxx>
@@ -251,6 +252,7 @@ public:
     void testTdf106736();
     void testMsWordCompTrailingBlanks();
     void testCreateDocxAnnotation();
+    void testTdf107976();
 
     CPPUNIT_TEST_SUITE(SwUiWriterTest);
     CPPUNIT_TEST(testReplaceForward);
@@ -390,6 +392,7 @@ public:
     CPPUNIT_TEST(testTdf106736);
     CPPUNIT_TEST(testMsWordCompTrailingBlanks);
     CPPUNIT_TEST(testCreateDocxAnnotation);
+    CPPUNIT_TEST(testTdf107976);
     CPPUNIT_TEST_SUITE_END();
 
 private:
@@ -4925,6 +4928,21 @@ void SwUiWriterTest::testCreateDocxAnnotation()
     CPPUNIT_ASSERT_EQUAL(aResultText, xField->getPropertyValue("Content").get<OUString>());
 }
 
+void SwUiWriterTest::testTdf107976()
+{
+    // Create a document and create two transferables.
+    SwDoc* pDoc = createDoc();
+    SwWrtShell& rShell = *pDoc->GetDocShell()->GetWrtShell();
+    rtl::Reference<SwTransferable> pTransferable(new SwTransferable(rShell));
+    rtl::Reference<SwTransferable> pTransferable2(new SwTransferable(rShell));
+    // Now close the document.
+    mxComponent->dispose();
+    mxComponent.clear();
+    // This failed: the first shell had a pointer to the deleted shell.
+    CPPUNIT_ASSERT(!pTransferable->GetShell());
+    CPPUNIT_ASSERT(!pTransferable2->GetShell());
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(SwUiWriterTest);
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/uibase/inc/uivwimp.hxx b/sw/source/uibase/inc/uivwimp.hxx
index 411e95e2e228..80209b9e8afa 100644
--- a/sw/source/uibase/inc/uivwimp.hxx
+++ b/sw/source/uibase/inc/uivwimp.hxx
@@ -88,7 +88,7 @@ class SwView_Impl
 {
     css::uno::Reference< css::frame::XDispatchProviderInterceptor >   xDisProvInterceptor;
     css::uno::Reference< css::view::XSelectionSupplier >              mxXTextView;       // UNO object
-    css::uno::WeakReference< css::lang::XUnoTunnel >                  xTransferable;
+    std::vector< css::uno::WeakReference< css::lang::XUnoTunnel > > mxTransferables;
 
     // temporary document for printing text of selection / multi selection
     // in PDF export.
diff --git a/sw/source/uibase/uiview/uivwimp.cxx b/sw/source/uibase/uiview/uivwimp.cxx
index 8b6818ccd7ca..01a123e02f97 100644
--- a/sw/source/uibase/uiview/uivwimp.cxx
+++ b/sw/source/uibase/uiview/uivwimp.cxx
@@ -208,15 +208,18 @@ void SwView_Impl::AddClipboardListener()
 void SwView_Impl::Invalidate()
 {
     GetUNOObject_Impl()->Invalidate();
-    Reference< XUnoTunnel > xTunnel(xTransferable.get(), UNO_QUERY);
-    if(xTunnel.is())
-
+    for (const auto& xTransferable: mxTransferables)
     {
-        SwTransferable* pTransferable = reinterpret_cast< SwTransferable * >(
-                sal::static_int_cast< sal_IntPtr >(
-                xTunnel->getSomething(SwTransferable::getUnoTunnelId())));
-        if(pTransferable)
-            pTransferable->Invalidate();
+        Reference< XUnoTunnel > xTunnel(xTransferable.get(), UNO_QUERY);
+        if(xTunnel.is())
+
+        {
+            SwTransferable* pTransferable = reinterpret_cast< SwTransferable * >(
+                    sal::static_int_cast< sal_IntPtr >(
+                    xTunnel->getSomething(SwTransferable::getUnoTunnelId())));
+            if(pTransferable)
+                pTransferable->Invalidate();
+        }
     }
 }
 
@@ -225,7 +228,7 @@ void SwView_Impl::AddTransferable(SwTransferable& rTransferable)
     //prevent removing of the non-referenced SwTransferable
     rTransferable.m_refCount++;
     {
-        xTransferable = Reference<XUnoTunnel> (&rTransferable);
+        mxTransferables.push_back(uno::WeakReference<lang::XUnoTunnel>(uno::Reference<lang::XUnoTunnel>(&rTransferable)));
     }
     rTransferable.m_refCount--;
 }