framework/source/uielement/menubarmanager.cxx |    4 +++-
 vcl/source/control/menubtn.cxx                |    4 ++++
 vcl/source/window/menu.cxx                    |    3 +++
 3 files changed, 10 insertions(+), 1 deletion(-)

New commits:
commit 40dfeb8d1e0828ff1f9f7d50e2ff894d45cce9b4
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue Jun 25 14:00:20 2019 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Tue Jun 25 21:09:57 2019 +0200

    tdf#126054 uses after free when menubutton and menu torn down during 
execution
    
    Change-Id: Ib79da121941863421bc12afa27e27cdd7e2e81e3
    Reviewed-on: https://gerrit.libreoffice.org/74696
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git a/framework/source/uielement/menubarmanager.cxx 
b/framework/source/uielement/menubarmanager.cxx
index 2638f9a8c022..fd61a275caeb 100644
--- a/framework/source/uielement/menubarmanager.cxx
+++ b/framework/source/uielement/menubarmanager.cxx
@@ -890,7 +890,9 @@ IMPL_LINK( MenuBarManager, Select, Menu *, pMenu, bool )
         }
     }
 
-    if ( xDispatch.is() )
+    // tdf#126054 don't let dispatch destroy this until after function 
completes
+    rtl::Reference<MenuBarManager> xRef(this);
+    if (xDispatch.is())
     {
         SolarMutexReleaser aReleaser;
         xDispatch->dispatch( aTargetURL, aArgs );
diff --git a/vcl/source/control/menubtn.cxx b/vcl/source/control/menubtn.cxx
index c6f6123c1a92..ccf336a46375 100644
--- a/vcl/source/control/menubtn.cxx
+++ b/vcl/source/control/menubtn.cxx
@@ -51,6 +51,10 @@ void MenuButton::ExecuteMenu()
         Point aPos(0, 1);
         tools::Rectangle aRect(aPos, aSize );
         mpMenu->Execute(this, aRect, PopupMenuFlags::ExecuteDown);
+
+        if (IsDisposed())
+            return;
+
         mnCurItemId = mpMenu->GetCurItemId();
         msCurItemIdent = mpMenu->GetCurItemIdent();
     }
diff --git a/vcl/source/window/menu.cxx b/vcl/source/window/menu.cxx
index 516d5930d183..87440cf3825d 100644
--- a/vcl/source/window/menu.cxx
+++ b/vcl/source/window/menu.cxx
@@ -2968,6 +2968,9 @@ sal_uInt16 PopupMenu::ImplExecute( const 
VclPtr<vcl::Window>& pW, const tools::R
         aSz.setHeight( ImplCalcHeight( nEntries ) );
     }
 
+    // tdf#126054 hold this until after function completes
+    VclPtr<PopupMenu> m_xThis(this);
+
     pWin->SetFocusId( xFocusId );
     pWin->SetOutputSizePixel( aSz );
     if ( GetItemCount() )
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

Reply via email to