crashtesting: use after free on export of tdf122510-1.xlsx to ods

and also tdf95549-3.xlsm

related to:

commit f8c1048eb437b1e685b76198165844e2ecc97a56
Date:   Wed May 19 19:04:02 2021 +0200

    fix leak in oox import

and:

commit 3cd6402c5443c8069c07d9e420d5ef5b43af6bef
Date:   Thu May 6 18:47:30 2021 +0200

    tdf#127301 XLSX import: hide hidden named range of autofilter

clearly this is fragile so just explicitly return who owns the
ScRangeData*

Change-Id: Ic3210bb8788bbbc85609bb384fa4a4625c15e487
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/116432
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

2 files changed, 6 insertions, 3 deletions

diff --git a/sc/source/filter/inc/defnamesbuffer.hxx b/sc/source/filter/inc/defnamesbuffer.hxx
index 03eec97af201..3200bd5dc8de 100644
--- a/sc/source/filter/inc/defnamesbuffer.hxx
+++ b/sc/source/filter/inc/defnamesbuffer.hxx
@@ -122,7 +122,7 @@ public:
 private:
     typedef ::std::unique_ptr< StreamDataSequence >   StreamDataSeqPtr;
 
-    ScRangeData*        mpScRangeData;       /// ScRangeData of the defined name.
+    RangeDataRet        maScRangeData;      /// ScRangeData of the defined name.
     sal_Int32           mnTokenIndex;       /// Name index used in API token array.
     sal_Int16           mnCalcSheet;        /// Calc sheet index for sheet-local names.
     sal_Unicode         mcBuiltinId;        /// Identifier for built-in defined names.
diff --git a/sc/source/filter/inc/workbookhelper.hxx b/sc/source/filter/inc/workbookhelper.hxx
index e6633d15f4f9..d6d04007d39c 100644
--- a/sc/source/filter/inc/workbookhelper.hxx
+++ b/sc/source/filter/inc/workbookhelper.hxx
@@ -160,10 +160,13 @@ public:
     css::uno::Reference< css::style::XStyle >
                         getStyleObject( const OUString& rStyleName, bool bPageStyle ) const;
 
+    // second is true if ownership belongs to the caller
+    typedef std::pair<ScRangeData*, bool> RangeDataRet;
+
     /** Creates and returns a defined name on-the-fly in the Calc document.
         The name will not be buffered in the global defined names buffer.
         @param orName  (in/out-parameter) Returns the resulting used name. */
-    ScRangeData* createNamedRangeObject(
+    RangeDataRet createNamedRangeObject(
                             OUString& orName,
                             const css::uno::Sequence< css::sheet::FormulaToken>& rTokens,
                             sal_Int32 nIndex,
@@ -172,7 +175,7 @@ public:
     /** Creates and returns a defined name on-the-fly in the sheet.
         The name will not be buffered in the global defined names buffer.
         @param orName  (in/out-parameter) Returns the resulting used name. */
-    ScRangeData* createLocalNamedRangeObject(
+    RangeDataRet createLocalNamedRangeObject(
                             OUString& orName,
                             const css::uno::Sequence< css::sheet::FormulaToken>& rTokens,
                             sal_Int32 nIndex,