sc/source/filter/oox/workbookhelper.cxx |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

New commits:
commit 5d6c31add6d2711a8adc89dd76600ba97c99d463
Author:     Caolán McNamara <[email protected]>
AuthorDate: Mon Dec 29 12:22:23 2025 +0000
Commit:     Caolán McNamara <[email protected]>
CommitDate: Mon Dec 29 20:29:17 2025 +0100

    ofz: Use-of-uninitialized-value
    
    move mpDoc so it outlives mxWorkbookSettings
    
    ==252==WARNING: MemorySanitizer: use-of-uninitialized-value
      #0 0x59c7604b8659 in oox::xls::WorkbookHelper::getScDocument() 
/src/libreoffice/sc/source/filter/oox/workbookhelper.cxx:835:5
      #1 0x59c7604bfab5 in oox::xls::WorkbookSettings::~WorkbookSettings() 
/src/libreoffice/sc/source/filter/oox/workbooksettings.cxx:118:5
      #2 0x59c7604bfd39 in oox::xls::WorkbookSettings::~WorkbookSettings() 
/src/libreoffice/sc/source/filter/oox/workbooksettings.cxx:115:1
      #3 0x59c7604aecaa in operator() 
/usr/local/include/c++/v1/__memory/unique_ptr.h:77:5
      #4 0x59c7604aecaa in reset 
/usr/local/include/c++/v1/__memory/unique_ptr.h:290:7
      #5 0x59c7604aecaa in ~unique_ptr 
/usr/local/include/c++/v1/__memory/unique_ptr.h:259:71
      #6 0x59c7604aecaa in oox::xls::WorkbookGlobals::~WorkbookGlobals() 
/src/libreoffice/sc/source/filter/oox/workbookhelper.cxx:332:1
      #7 0x59c76042ffc5 in __release_shared 
/usr/local/include/c++/v1/__memory/shared_count.h:92:7
      #8 0x59c76042ffc5 in __release_shared 
/usr/local/include/c++/v1/__memory/shared_count.h:121:25
      #9 0x59c76042ffc5 in ~shared_ptr 
/usr/local/include/c++/v1/__memory/shared_ptr.h:561:17
      #10 0x59c76042ffc5 in oox::xls::ExcelFilter::importDocument() 
/src/libreoffice/sc/source/filter/oox/excelfilter.cxx:128:5
      #11 0x59c7649852b3 in 
oox::core::FilterBase::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) /src/libreoffice/oox/source/core/filterbase.cxx:485:49
      #12 0x59c76043123f in 
oox::xls::ExcelFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) /src/libreoffice/sc/source/filter/oox/excelfilter.cxx:178:25
      #13 0x59c754219102 in TestImportXLSX 
/src/libreoffice/sc/source/filter/xml/xmlimprt.cxx:1834:24
      #14 0x59c7541ec1c1 in LLVMFuzzerTestOneInput 
/src/libreoffice/vcl/workben/xlsxfuzzer.cxx:27:11
      #15 0x59c75411844d in fuzzer::Fuzzer::ExecuteCallback(unsigned char 
const*, unsigned long) 
/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
      #16 0x59c7541032d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, 
unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
      #17 0x59c7541091a0 in fuzzer::FuzzerDriver(int*, char***, int 
(*)(unsigned char const*, unsigned long)) 
/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
      #18 0x59c754133ca2 in main 
/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
      #19 0x7f6d38582082 in __libc_start_main 
/build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
      #20 0x59c7540fc8ad in _start
    
    Member fields were destroyed
      #0 0x59c75418c47d in __sanitizer_dtor_callback_fields 
/src/llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:1074:5
      #1 0x59c7604ade4d in ~WorkbookGlobals 
/src/libreoffice/sc/source/filter/oox/workbookhelper.cxx:302:25
      #2 0x59c7604ade4d in oox::xls::WorkbookGlobals::~WorkbookGlobals() 
/src/libreoffice/sc/source/filter/oox/workbookhelper.cxx:332:1
      #3 0x59c76042ffc5 in __release_shared 
/usr/local/include/c++/v1/__memory/shared_count.h:92:7
      #4 0x59c76042ffc5 in __release_shared 
/usr/local/include/c++/v1/__memory/shared_count.h:121:25
      #5 0x59c76042ffc5 in ~shared_ptr 
/usr/local/include/c++/v1/__memory/shared_ptr.h:561:17
      #6 0x59c76042ffc5 in oox::xls::ExcelFilter::importDocument() 
/src/libreoffice/sc/source/filter/oox/excelfilter.cxx:128:5
      #7 0x59c7649852b3 in 
oox::core::FilterBase::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) /src/libreoffice/oox/source/core/filterbase.cxx:485:49
      #8 0x59c76043123f in 
oox::xls::ExcelFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&) /src/libreoffice/sc/source/filter/oox/excelfilter.cxx:178:25
      #9 0x59c754219102 in TestImportXLSX 
/src/libreoffice/sc/source/filter/xml/xmlimprt.cxx:1834:24
    
    Change-Id: Ica262f2c18223fe754fc29609318b18153eed355
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196301
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/sc/source/filter/oox/workbookhelper.cxx 
b/sc/source/filter/oox/workbookhelper.cxx
index a8b534fe9032..f29c89cdf608 100644
--- a/sc/source/filter/oox/workbookhelper.cxx
+++ b/sc/source/filter/oox/workbookhelper.cxx
@@ -268,6 +268,8 @@ private:
     ExcelFilter&        mrExcelFilter;          /// Base object for 
registration of this structure.
     ProgressBarPtr      mxProgressBar;          /// The progress bar.
     StorageRef          mxVbaPrjStrg;           /// Storage containing the VBA 
project.
+    ScDocument*         mpDoc;
+    ScDocShell*         mpDocShell;
     sal_Int16           mnCurrSheet;            /// Current sheet index in 
Calc document.
     bool                mbGeneratorKnownGood;   /// Whether reading a file 
generated by Excel or Calc.
     bool                mbHasCalculatedFormulaCells;  /// Assumed to have 
calculated formula cells.
@@ -303,17 +305,15 @@ private:
 
     // BIFF2-BIFF8 specific
     rtl_TextEncoding    meTextEnc;              /// BIFF byte string text 
encoding.
-    ScDocument* mpDoc;
-    ScDocShell* mpDocShell;
     std::unique_ptr<ScDocumentImport> mxDocImport;
 };
 
 WorkbookGlobals::WorkbookGlobals( ExcelFilter& rFilter ) :
     mrBaseFilter( rFilter ),
     mrExcelFilter( rFilter ),
-    mpOoxFilter( &rFilter ),
     mpDoc(nullptr),
-    mpDocShell(nullptr)
+    mpDocShell(nullptr),
+    mpOoxFilter( &rFilter )
 {
     // register at the filter, needed for virtual callbacks (even during 
construction)
     mrExcelFilter.registerWorkbookGlobals( *this );

Reply via email to