sc/source/ui/unoobj/chart2uno.cxx |    1 +
 sd/inc/stlsheet.hxx               |    3 ---
 sd/source/core/stlsheet.cxx       |   26 ++++----------------------
 3 files changed, 5 insertions(+), 25 deletions(-)

New commits:
commit ae44d2affa524045735232c6e1b4f851bd4d48ad
Author:     Noel Grandin <[email protected]>
AuthorDate: Wed Oct 9 20:25:38 2024 +0200
Commit:     Noel Grandin <[email protected]>
CommitDate: Thu Oct 10 09:18:20 2024 +0200

    cid#1607338 Data race condition
    
    move this logic to the destructor, like we do elsewhere
    
    Change-Id: Ie41c78b0a01d79020cb77fd5be70116f473e910f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/174747
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <[email protected]>

diff --git a/sd/inc/stlsheet.hxx b/sd/inc/stlsheet.hxx
index fc3db5d68cd2..aa7238e5b0e8 100644
--- a/sd/inc/stlsheet.hxx
+++ b/sd/inc/stlsheet.hxx
@@ -87,9 +87,6 @@ public:
     // SfxStyleSheetBase
     virtual bool SetName(const OUString& rNewName, bool bReindexNow = true) 
override;
 
-    // XInterface
-    virtual void SAL_CALL release(  ) noexcept override;
-
     // XServiceInfo
     virtual OUString SAL_CALL getImplementationName() override;
     virtual sal_Bool SAL_CALL supportsService( const OUString& ServiceName ) 
override;
diff --git a/sd/source/core/stlsheet.cxx b/sd/source/core/stlsheet.cxx
index 4c61c8d72b1c..1293e4740b9f 100644
--- a/sd/source/core/stlsheet.cxx
+++ b/sd/source/core/stlsheet.cxx
@@ -149,6 +149,10 @@ SdStyleSheet::SdStyleSheet(const OUString& rDisplayName, 
SfxStyleSheetBasePool&
 
 SdStyleSheet::~SdStyleSheet()
 {
+    // restore reference count, prevent double-delete from calling dispose
+    osl_atomic_increment( &m_refCount );
+    dispose();
+
     delete pSet;
     pSet = nullptr;    // that following destructors also get a change
 }
@@ -727,28 +731,6 @@ rtl::Reference<SdStyleSheet> 
SdStyleSheet::CreateEmptyUserStyle( SfxStyleSheetBa
     return new SdStyleSheet(aName, rPool, eFamily, 
SfxStyleSearchBits::UserDefined);
 }
 
-// XInterface
-
-void SAL_CALL SdStyleSheet::release(  ) noexcept
-{
-    if (osl_atomic_decrement( &m_refCount ) != 0)
-        return;
-
-    // restore reference count:
-    osl_atomic_increment( &m_refCount );
-    if (! m_bDisposed) try
-    {
-        dispose();
-    }
-    catch (RuntimeException const&)
-    {
-        // don't break throw ()
-        TOOLS_WARN_EXCEPTION( "sd", "" );
-    }
-    OSL_ASSERT( m_bDisposed );
-    SdStyleSheetBase::release();
-}
-
 // XComponent
 
 void SAL_CALL SdStyleSheet::dispose(  )
commit 950c4537a65d6a9981c0b7e392190cf72837596d
Author:     Noel Grandin <[email protected]>
AuthorDate: Wed Oct 9 19:41:45 2024 +0200
Commit:     Noel Grandin <[email protected]>
CommitDate: Thu Oct 10 09:18:07 2024 +0200

    cid#1607842 Overflowed constant
    
    Change-Id: I11bcbe62181ec85c9d61cb9b4f9d0a3adad92890
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/174743
    Reviewed-by: Noel Grandin <[email protected]>
    Tested-by: Jenkins

diff --git a/sc/source/ui/unoobj/chart2uno.cxx 
b/sc/source/ui/unoobj/chart2uno.cxx
index 8957416e4025..4df7c3562b9c 100644
--- a/sc/source/ui/unoobj/chart2uno.cxx
+++ b/sc/source/ui/unoobj/chart2uno.cxx
@@ -739,6 +739,7 @@ void Chart2Positioner::createPositionMap()
         SCCOL nCol1 = s.Col(), nCol2 = e.Col();
         SCROW nRow1 = s.Row(), nRow2 = e.Row();
         SCTAB nTab1 = s.Tab(), nTab2 = e.Tab();
+        assert(nTab2 < MAXTABCOUNT);
 
         for (SCTAB nTab = nTab1; nTab <= nTab2; ++nTab)
         {

Reply via email to