framework/source/uielement/menubarmanager.cxx | 4 +++- vcl/source/control/menubtn.cxx | 4 ++++ vcl/source/window/menu.cxx | 3 +++ 3 files changed, 10 insertions(+), 1 deletion(-)
New commits: commit 40dfeb8d1e0828ff1f9f7d50e2ff894d45cce9b4 Author: Caolán McNamara <caol...@redhat.com> AuthorDate: Tue Jun 25 14:00:20 2019 +0100 Commit: Caolán McNamara <caol...@redhat.com> CommitDate: Tue Jun 25 21:09:57 2019 +0200 tdf#126054 uses after free when menubutton and menu torn down during execution Change-Id: Ib79da121941863421bc12afa27e27cdd7e2e81e3 Reviewed-on: https://gerrit.libreoffice.org/74696 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/framework/source/uielement/menubarmanager.cxx b/framework/source/uielement/menubarmanager.cxx index 2638f9a8c022..fd61a275caeb 100644 --- a/framework/source/uielement/menubarmanager.cxx +++ b/framework/source/uielement/menubarmanager.cxx @@ -890,7 +890,9 @@ IMPL_LINK( MenuBarManager, Select, Menu *, pMenu, bool ) } } - if ( xDispatch.is() ) + // tdf#126054 don't let dispatch destroy this until after function completes + rtl::Reference<MenuBarManager> xRef(this); + if (xDispatch.is()) { SolarMutexReleaser aReleaser; xDispatch->dispatch( aTargetURL, aArgs ); diff --git a/vcl/source/control/menubtn.cxx b/vcl/source/control/menubtn.cxx index c6f6123c1a92..ccf336a46375 100644 --- a/vcl/source/control/menubtn.cxx +++ b/vcl/source/control/menubtn.cxx @@ -51,6 +51,10 @@ void MenuButton::ExecuteMenu() Point aPos(0, 1); tools::Rectangle aRect(aPos, aSize ); mpMenu->Execute(this, aRect, PopupMenuFlags::ExecuteDown); + + if (IsDisposed()) + return; + mnCurItemId = mpMenu->GetCurItemId(); msCurItemIdent = mpMenu->GetCurItemIdent(); } diff --git a/vcl/source/window/menu.cxx b/vcl/source/window/menu.cxx index 516d5930d183..87440cf3825d 100644 --- a/vcl/source/window/menu.cxx +++ b/vcl/source/window/menu.cxx @@ -2968,6 +2968,9 @@ sal_uInt16 PopupMenu::ImplExecute( const VclPtr<vcl::Window>& pW, const tools::R aSz.setHeight( ImplCalcHeight( nEntries ) ); } + // tdf#126054 hold this until after function completes + VclPtr<PopupMenu> m_xThis(this); + pWin->SetFocusId( xFocusId ); pWin->SetOutputSizePixel( aSz ); if ( GetItemCount() ) _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits