sc/inc/scmod.hxx               |    2 +-
 sc/source/ui/app/drwtrans.cxx  |    6 ++++--
 sc/source/ui/app/scmod.cxx     |    9 ++++-----
 sc/source/ui/app/transobj.cxx  |    7 ++++---
 sc/source/ui/view/gridwin.cxx  |   10 ++++++++--
 sc/source/ui/view/tabcont.cxx  |   18 ++++++++++--------
 sc/source/ui/view/viewfun7.cxx |    4 ++--
 7 files changed, 33 insertions(+), 23 deletions(-)

New commits:
commit 19992b8f238dbfe398b4d7c625905c8ca9ad9845
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Tue May 6 13:10:43 2025 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Wed May 7 09:30:47 2025 +0200

    null-deref on doc teardown
    
     #0  std::__uniq_ptr_impl<ScDragData, std::default_delete<ScDragData> 
>::_M_ptr (this=0xae8)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/unique_ptr.h:191
     #1  std::unique_ptr<ScDragData, std::default_delete<ScDragData> >::get 
(this=0xae8)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/unique_ptr.h:462
     #2  std::unique_ptr<ScDragData, std::default_delete<ScDragData> 
>::operator* (this=0xae8)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/unique_ptr.h:445
     #3  ScTabViewShell::GetDragData (this=0x0)
         at sc/source/ui/inc/tabvwsh.hxx:470
     #4  ScModule::GetDragData (this=this@entry=0x4f2dacd0)
         at sc/source/ui/app/scmod.cxx:632
     #5  0x00007e73ef1b3584 in ScDrawTransferObj::~ScDrawTransferObj 
(this=0x5a10c1c0, __in_chrg=<optimized out>)
         at sc/source/ui/app/drwtrans.cxx:219
     #6  0x00007e73ef1b381d in ScDrawTransferObj::~ScDrawTransferObj 
(this=0x5a10c1c0, __in_chrg=<optimized out>)
         at sc/source/ui/app/drwtrans.cxx:233
     #7  0x00007e74010d80b9 in 
com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable>::~Reference
 (
         this=0x40a2d160, __in_chrg=<optimized out>)
         at include/com/sun/star/uno/Reference.hxx:114
     #8  vcl::(anonymous namespace)::GenericDragSource::~GenericDragSource 
(this=0x40a2d110, __in_chrg=<optimized out>,
         __vtt_parm=<optimized out>)
    
    Change-Id: Ibce052c40972576e149d643a4dbbe4f9e89d9a8d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/184992
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sc/inc/scmod.hxx b/sc/inc/scmod.hxx
index d51e742003c4..5686f8c42d89 100644
--- a/sc/inc/scmod.hxx
+++ b/sc/inc/scmod.hxx
@@ -134,7 +134,7 @@ public:
     void                AnythingChanged();
 
     //  Drag & Drop:
-    const ScDragData&   GetDragData() const;
+    const ScDragData*   GetDragData() const;
     void                SetDragObject( ScTransferObj* pCellObj, 
ScDrawTransferObj* pDrawObj );
     void                ResetDragObject();
     void                SetDragLink(
diff --git a/sc/source/ui/app/drwtrans.cxx b/sc/source/ui/app/drwtrans.cxx
index f4e3ca9fa10e..10d163e580c8 100644
--- a/sc/source/ui/app/drwtrans.cxx
+++ b/sc/source/ui/app/drwtrans.cxx
@@ -216,7 +216,8 @@ ScDrawTransferObj::~ScDrawTransferObj()
     SolarMutexGuard aSolarGuard;
 
     ScModule* pScMod = ScModule::get();
-    if (pScMod && pScMod->GetDragData().pDrawTransfer == this)
+    const ScDragData* pDragData = pScMod ? pScMod->GetDragData() : nullptr;
+    if (pDragData && pDragData->pDrawTransfer == this)
     {
         OSL_FAIL("ScDrawTransferObj wasn't released");
         pScMod->ResetDragObject();
@@ -569,7 +570,8 @@ void ScDrawTransferObj::DragFinished( sal_Int8 nDropAction )
     }
 
     ScModule* pScMod = ScModule::get();
-    if ( pScMod->GetDragData().pDrawTransfer == this )
+    const ScDragData* pDragData = pScMod ? pScMod->GetDragData() : nullptr;
+    if (pDragData && pDragData->pDrawTransfer == this)
         pScMod->ResetDragObject();
 
     m_pDragSourceView.reset();
diff --git a/sc/source/ui/app/scmod.cxx b/sc/source/ui/app/scmod.cxx
index e27ba3cd98f9..bfca56475ba6 100644
--- a/sc/source/ui/app/scmod.cxx
+++ b/sc/source/ui/app/scmod.cxx
@@ -623,16 +623,15 @@ void ScModule::ResetDragObject()
     }
 }
 
-const ScDragData& ScModule::GetDragData() const
+const ScDragData* ScModule::GetDragData() const
 {
     if (comphelper::LibreOfficeKit::isActive())
     {
         ScTabViewShell* pViewShell = ScTabViewShell::GetActiveViewShell();
-        assert(pViewShell);
-        return pViewShell->GetDragData();
+        return pViewShell ? &pViewShell->GetDragData() : nullptr;
     }
-    else
-        return *m_pDragData;
+
+    return m_pDragData.get();
 }
 
 void ScModule::SetDragObject( ScTransferObj* pCellObj, ScDrawTransferObj* 
pDrawObj )
diff --git a/sc/source/ui/app/transobj.cxx b/sc/source/ui/app/transobj.cxx
index afa196082728..26e34f945aae 100644
--- a/sc/source/ui/app/transobj.cxx
+++ b/sc/source/ui/app/transobj.cxx
@@ -180,9 +180,9 @@ ScTransferObj::~ScTransferObj()
 {
     SolarMutexGuard aSolarGuard;
 
-    bool bIsDisposing = comphelper::LibreOfficeKit::isActive() && 
!ScTabViewShell::GetActiveViewShell();
     ScModule* pScMod = ScModule::get();
-    if (pScMod && !bIsDisposing && pScMod->GetDragData().pCellTransfer == this)
+    const ScDragData* pDragData = pScMod ? pScMod->GetDragData() : nullptr;
+    if (pDragData && pDragData->pCellTransfer == this)
     {
         OSL_FAIL("ScTransferObj wasn't released");
         pScMod->ResetDragObject();
@@ -602,7 +602,8 @@ void ScTransferObj::DragFinished( sal_Int8 nDropAction )
     }
 
     ScModule* pScMod = ScModule::get();
-    if ( pScMod && pScMod->GetDragData().pCellTransfer == this )
+    const ScDragData* pDragData = pScMod ? pScMod->GetDragData() : nullptr;
+    if (pDragData && pDragData->pCellTransfer == this)
         pScMod->ResetDragObject();
 
     m_xDragSourceRanges = nullptr;       // don't keep source after dropping
diff --git a/sc/source/ui/view/gridwin.cxx b/sc/source/ui/view/gridwin.cxx
index faaa9ba51c82..74aa073dab30 100644
--- a/sc/source/ui/view/gridwin.cxx
+++ b/sc/source/ui/view/gridwin.cxx
@@ -4229,7 +4229,10 @@ sal_Int8 ScGridWindow::AcceptPrivateDrop( const 
AcceptDropEvent& rEvt, const ScD
 
 sal_Int8 ScGridWindow::AcceptDrop( const AcceptDropEvent& rEvt )
 {
-    const ScDragData& rData = ScModule::get()->GetDragData();
+    const ScDragData* pData = ScModule::get()->GetDragData();
+    if (!pData)
+        return DND_ACTION_NONE;
+    const ScDragData& rData = *pData;
     if ( rEvt.mbLeaving )
     {
         DrawMarkDropObj( nullptr );
@@ -4881,7 +4884,10 @@ sal_Int8 ScGridWindow::ExecuteDrop( const 
ExecuteDropEvent& rEvt )
     DrawMarkDropObj( nullptr );    // drawing layer
 
     ScModule* pScMod = ScModule::get();
-    const ScDragData& rData = pScMod->GetDragData();
+    const ScDragData* pData = pScMod->GetDragData();
+    if (!pData)
+        return DND_ACTION_NONE;
+    const ScDragData& rData = *pData;
     if (rData.pCellTransfer)
         return ExecutePrivateDrop( rEvt, rData );
 
diff --git a/sc/source/ui/view/tabcont.cxx b/sc/source/ui/view/tabcont.cxx
index 4582900557f9..c33500a9a5df 100644
--- a/sc/source/ui/view/tabcont.cxx
+++ b/sc/source/ui/view/tabcont.cxx
@@ -541,15 +541,16 @@ sal_Int8 ScTabControl::ExecuteDrop( const 
ExecuteDropEvent& rEvt )
     EndSwitchPage();
 
     ScDocument& rDoc = rViewData.GetDocument();
-    const ScDragData& rData = ScModule::get()->GetDragData();
-    if ( rData.pCellTransfer && (rData.pCellTransfer->GetDragSourceFlags() & 
ScDragSrc::Table) &&
-            rData.pCellTransfer->GetSourceDocument() == &rDoc )
+    const ScDragData* pData = ScModule::get()->GetDragData();
+    if ( pData && pData->pCellTransfer &&
+         (pData->pCellTransfer->GetDragSourceFlags() & ScDragSrc::Table) &&
+         pData->pCellTransfer->GetSourceDocument() == &rDoc )
     {
         // moving of tables within the document
         SCTAB nPos = GetPrivatDropPos( rEvt.maPosPixel );
         HideDropPos();
 
-        if ( nPos == rData.pCellTransfer->GetVisibleTab() && rEvt.mnAction == 
DND_ACTION_MOVE )
+        if ( nPos == pData->pCellTransfer->GetVisibleTab() && rEvt.mnAction == 
DND_ACTION_MOVE )
         {
             // #i83005# do nothing - don't move to the same position
             // (too easily triggered unintentionally, and might take a long 
time in large documents)
@@ -561,7 +562,7 @@ sal_Int8 ScTabControl::ExecuteDrop( const ExecuteDropEvent& 
rEvt )
                 //! use table selection from the tab control where dragging 
was started?
                 rViewData.GetView()->MoveTable( lcl_DocShellNr(rDoc), nPos, 
rEvt.mnAction != DND_ACTION_MOVE );
 
-                rData.pCellTransfer->SetDragWasInternal();          // don't 
delete
+                pData->pCellTransfer->SetDragWasInternal();          // don't 
delete
                 return DND_ACTION_COPY;
             }
         }
@@ -580,9 +581,10 @@ sal_Int8 ScTabControl::AcceptDrop( const AcceptDropEvent& 
rEvt )
     }
 
     const ScDocument& rDoc = rViewData.GetDocument();
-    const ScDragData& rData = ScModule::get()->GetDragData();
-    if ( rData.pCellTransfer && (rData.pCellTransfer->GetDragSourceFlags() & 
ScDragSrc::Table) &&
-            rData.pCellTransfer->GetSourceDocument() == &rDoc )
+    const ScDragData* pData = ScModule::get()->GetDragData();
+    if ( pData && pData->pCellTransfer &&
+         (pData->pCellTransfer->GetDragSourceFlags() & ScDragSrc::Table) &&
+         pData->pCellTransfer->GetSourceDocument() == &rDoc )
     {
         // moving of tables within the document
         if ( !rDoc.GetChangeTrack() && rDoc.IsDocEditable() )
diff --git a/sc/source/ui/view/viewfun7.cxx b/sc/source/ui/view/viewfun7.cxx
index 697ba07cc1af..87b25b9dc8eb 100644
--- a/sc/source/ui/view/viewfun7.cxx
+++ b/sc/source/ui/view/viewfun7.cxx
@@ -92,8 +92,8 @@ void ScViewFunc::PasteDraw( const Point& rLogicPos, SdrModel* 
pModel,
     bool bNegativePage = GetViewData().GetDocument().IsNegativePage( 
GetViewData().GetTabNo() );
 
     SdrView* pDragEditView = nullptr;
-    const ScDragData& rData = ScModule::get()->GetDragData();
-    ScDrawTransferObj* pDrawTrans = rData.pDrawTransfer;
+    const ScDragData* pData = ScModule::get()->GetDragData();
+    ScDrawTransferObj* pDrawTrans = pData ? pData->pDrawTransfer : nullptr;
     if (pDrawTrans)
     {
         pDragEditView = pDrawTrans->GetDragSourceView();

Reply via email to