Fix heap-use-after-free
...as seen once during JunitTest_forms_complex, > ==2007790==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ccbfe8b3a38 at pc 0x7f5c5361ed51 bp 0x7b5bd4ac7420 sp 0x7b5bd4ac7418 > READ of size 2 at 0x7ccbfe8b3a38 thread T8 > #0 in SfxItemPool::IsInRange(unsigned short) const at engine/include/svl/itempool.hxx:331:66 > #1 in SfxItemPool::getTargetPool(unsigned short) const at engine/svl/source/items/itempool.cxx:452:9 > #2 in SfxItemPool::CheckItemInfoFlag(unsigned short, unsigned short) const at engine/svl/source/items/itempool.cxx:461:26 > #3 in SfxItemPool::NeedsSurrogateSupport(unsigned short) const at engine/include/svl/itempool.hxx:343:18 > #4 in SfxItemSet::checkRemovePoolRegistration(SfxPoolItem const*) at engine/svl/source/items/itemset.cxx:384:20 > #5 in SfxItemSet::ClearSingleItem_PrepareRemove(SfxPoolItem const*) at engine/svl/source/items/itemset.cxx:364:5 > #6 in SfxItemSet::ClearAllItemsImpl() at engine/svl/source/items/itemset.cxx:443:9 > #7 in SfxItemSet::~SfxItemSet() at engine/svl/source/items/itemset.cxx:318:5 > #8 in std::_Optional_payload_base<SfxItemSet>::_M_destroy() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:305:23 > #9 in std::_Optional_payload_base<SfxItemSet>::_M_reset() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:341:4 > #10 in std::_Optional_payload<SfxItemSet, false, false, false>::~_Optional_payload() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:464:57 > #11 in std::_Optional_base<SfxItemSet, false, false>::~_Optional_base() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:488:12 > #12 in std::optional<SfxItemSet>::~optional() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:781:11 > #13 in sdr::properties::DefaultProperties::~DefaultProperties() at engine/svx/source/sdr/properties/defaultproperties.cxx:92:50 > #14 in sdr::properties::AttributeProperties::~AttributeProperties() at engine/svx/source/sdr/properties/attributeproperties.cxx:221:9 > #15 in sdr::properties::TextProperties::~TextProperties() at engine/svx/source/sdr/properties/textproperties.cxx:79:9 > #16 in sdr::properties::RectangleProperties::~RectangleProperties() at engine/svx/source/sdr/properties/rectangleproperties.cxx:38:9 > #17 in sdr::properties::RectangleProperties::~RectangleProperties() at engine/svx/source/sdr/properties/rectangleproperties.cxx:37:9 > #18 in std::default_delete<sdr::properties::BaseProperties>::operator()(sdr::properties::BaseProperties*) const at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/unique_ptr.h:92:2 > #19 in std::__uniq_ptr_impl<sdr::properties::BaseProperties, std::default_delete<sdr::properties::BaseProperties>>::reset(sdr::properties::BaseProperties*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/unique_ptr.h:204:4 > #20 in std::unique_ptr<sdr::properties::BaseProperties, std::default_delete<sdr::properties::BaseProperties>>::reset(sdr::properties::BaseProperties*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/unique_ptr.h:530:7 > #21 in SdrObject::~SdrObject() at engine/svx/source/svdraw/svdobj.cxx:589:18 > #22 in SdrAttrObj::~SdrAttrObj() at engine/svx/source/svdraw/svdoattr.cxx:42:28 > #23 in SdrTextObj::~SdrTextObj() at engine/svx/source/svdraw/svdotext.cxx:156:1 > #24 in SdrRectObj::~SdrRectObj() at engine/svx/source/svdraw/svdorect.cxx:69:25 > #25 in SdrUnoObj::~SdrUnoObj() at engine/svx/source/svdraw/svdouno.cxx:223:1 > #26 in FmFormObj::~FmFormObj() at engine/svx/source/form/fmobj.cxx:120:1 > #27 in FmFormObj::~FmFormObj() at engine/svx/source/form/fmobj.cxx:113:1 > #28 in SdrObject::release() at engine/svx/source/svdraw/svdobj.cxx:612:9 > #29 in rtl::Reference<SdrObject>::clear() at engine/include/rtl/ref.hxx:181:19 > #30 in SvxShape::~SvxShape() at engine/svx/source/unodraw/unoshape.cxx:199:21 > #31 in SvxShapeText::~SvxShapeText() at engine/svx/source/unodraw/unoshape.cxx:3828:1 > #32 in SvxShapeControl::~SvxShapeControl() at engine/svx/source/unodraw/unoshap2.cxx:393:1 > #33 in SvxShapeControl::~SvxShapeControl() at engine/svx/source/unodraw/unoshap2.cxx:392:1 > #34 in cppu::OWeakObject::release() at engine/cppuhelper/source/weak.cxx:231:9 > #35 in cppu::OWeakAggObject::release() at engine/cppuhelper/source/weak.cxx:293:22 > #36 in cppu::WeakAggImplHelper12<com::sun::star::drawing::XShape, com::sun::star::lang::XComponent, com::sun::star::beans::XPropertySet, com::sun::star::beans::XMultiPropertySet, com::sun::star::beans::XPropertyState, com::sun::star::lang::XUnoTunnel, com::sun::star::container::XNamed, com::sun::star::drawing::XGluePointsSupplier, com::sun::star::container::XChild, com::sun::star::lang::XServiceInfo, com::sun::star::document::XActionLockable, com::sun::star::beans::XMultiPropertyStates>::release() at engine/include/cppuhelper/implbase12.hxx:161:31 > #37 in SvxShapeText::release() at engine/include/svx/unoshape.hxx:357:17 > #38 in SvxShapeControl::release() at engine/include/svx/unoshape.hxx:508:21 > #39 in freeUnoInterfaceProxy at engine/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:42:19 > #40 in (anonymous namespace)::s_stub_defenv_revokeInterface(__va_list_tag (*) [1]) at engine/cppu/source/uno/lbenv.cxx:369:17 > #41 in s_environment_invoke_v(_uno_Environment*, _uno_Environment*, void (*)(__va_list_tag (*) [1]), __va_list_tag (*) [1]) at engine/cppu/source/uno/EnvStack.cxx:292:9 > #42 in uno_Environment_invoke_v at engine/cppu/source/uno/EnvStack.cxx:310:5 > #43 in uno_Environment_invoke at engine/cppu/source/uno/EnvStack.cxx:318:5 > #44 in (anonymous namespace)::defenv_revokeInterface(_uno_ExtEnvironment*, void*) at engine/cppu/source/uno/lbenv.cxx:423:5 > #45 in releaseProxy at engine/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:78:9 > #46 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference() at engine/include/uno/dispatcher.hxx:93:9 > #47 in binaryurp::Bridge::releaseStub(rtl::OUString const&, com::sun::star::uno::TypeDescription const&) at engine/binaryurp/source/bridge.cxx:509:1 > #48 in binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny*, std::__debug::vector<binaryurp::BinaryAny, std::allocator<binaryurp::BinaryAny>>*) const at engine/binaryurp/source/incomingrequest.cxx:138:18 > #49 in binaryurp::IncomingRequest::execute() const at engine/binaryurp/source/incomingrequest.cxx:79:26 > #50 in request at engine/binaryurp/source/reader.cxx:86:9 > #51 in cppu_threadpool::JobQueue::enter(void const*, bool) at engine/cppu/source/threadpool/jobqueue.cxx:100:17 > #52 in cppu_threadpool::ORequestThread::run() at engine/cppu/source/threadpool/thread.cxx:165:31 > #53 in threadFunc at engine/include/osl/thread.hxx:175:15 > #54 in osl_thread_start_Impl(void*) at engine/sal/osl/unx/thread.cxx:240:9 > > 0x7ccbfe8b3a38 is located 184 bytes inside of 648-byte region [0x7ccbfe8b3980,0x7ccbfe8b3c08) > freed by thread T23 here: > #0 in operator delete(void*, unsigned long) at ~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:187:3 > #1 in SdrItemPool::~SdrItemPool() at engine/svx/source/svdraw/svdattr.cxx:514:1 > #2 in salhelper::SimpleReferenceObject::release() at engine/include/salhelper/simplereferenceobject.hxx:61:13 > #3 in rtl::Reference<SfxItemPool>::~Reference() at engine/include/rtl/ref.hxx:116:22 > #4 in SdrModel::~SdrModel() at engine/svx/source/svdraw/svdmodel.cxx:275:1 > #5 in FmFormModel::~FmFormModel() at engine/svx/source/form/fmmodel.cxx:69:1 > #6 in SdDrawDocument::~SdDrawDocument() at engine/sd/source/core/drawdoc.cxx:418:1 > #7 in sd::DrawDocShell::~DrawDocShell() at engine/sd/source/ui/docshell/docshell.cxx:192:9 > #8 in sd::GraphicDocShell::~GraphicDocShell() at engine/sd/source/ui/docshell/grdocsh.cxx:57:38 > #9 in sd::GraphicDocShell::~GraphicDocShell() at engine/sd/source/ui/docshell/grdocsh.cxx:57:37 > #10 in cppu::OWeakObject::release() at engine/cppuhelper/source/weak.cxx:231:9 > #11 in rtl::Reference<SfxObjectShell>::~Reference() at engine/include/rtl/ref.hxx:116:22 > #12 in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer() at engine/sfx2/source/doc/sfxbasemodel.cxx:268:5 > #13 in void std::destroy_at<IMPL_SfxBaseModel_DataContainer>(IMPL_SfxBaseModel_DataContainer*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/stl_construct.h:88:15 > #14 in void std::_Destroy<IMPL_SfxBaseModel_DataContainer>(IMPL_SfxBaseModel_DataContainer*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/stl_construct.h:164:7 > #15 in void std::allocator_traits<std::allocator<void>>::destroy<IMPL_SfxBaseModel_DataContainer>(std::allocator<void>&, IMPL_SfxBaseModel_DataContainer*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/alloc_traits.h:863:4 > #16 in std::_Sp_counted_ptr_inplace<IMPL_SfxBaseModel_DataContainer, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:650:2 > #17 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:423:8 > #18 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:1100:11 > #19 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:1574:31 > #20 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::reset() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:1692:9 > #21 in SfxBaseModel::dispose() at engine/sfx2/source/doc/sfxbasemodel.cxx:802:13 > #22 in SdXImpressDocument::dispose() at engine/sd/source/ui/unoidl/unomodel.cxx:5515:19 > #23 in SfxBaseModel::close(bool) at engine/sfx2/source/doc/sfxbasemodel.cxx:1544:5 > #24 in gcc3::callVirtualMethod(void*, unsigned int, void*, _typelib_TypeDescriptionReference*, bool, unsigned long*, unsigned int, unsigned long*, double*) at engine/bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:87:5 > #25 in cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy*, bridges::cpp_uno::shared::VtableSlot, _typelib_TypeDescriptionReference*, int, _typelib_MethodParameter*, void*, void**, _uno_Any**) at engine/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:230:13 > #26 in unoInterfaceProxyDispatch at engine/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:410:13 > #27 in binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny*, std::__debug::vector<binaryurp::BinaryAny, std::allocator<binaryurp::BinaryAny>>*) const at engine/binaryurp/source/incomingrequest.cxx:236:13 > #28 in binaryurp::IncomingRequest::execute() const at engine/binaryurp/source/incomingrequest.cxx:79:26 > #29 in request at engine/binaryurp/source/reader.cxx:86:9 > #30 in cppu_threadpool::JobQueue::enter(void const*, bool) at engine/cppu/source/threadpool/jobqueue.cxx:100:17 > #31 in cppu_threadpool::ORequestThread::run() at engine/cppu/source/threadpool/thread.cxx:165:31 > #32 in threadFunc at engine/include/osl/thread.hxx:175:15 > #33 in osl_thread_start_Impl(void*) at engine/sal/osl/unx/thread.cxx:240:9 Change-Id: Ib38eb730f9178976d4432f77857b4f09ebfbdbcf Signed-off-by: Stephan Bergmann <stephan.bergmann@collabora.com> Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6296 Tested-by: Jenkins CPCI <releng@collaboraoffice.com> Reviewed-by: Michael Stahl <michael.stahl@collabora.com> (cherry picked from commit 7a151cb95d66be93ef2a2687d1ff55ca37daa410) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211728 Tested-by: Jenkins Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Stephan Bergmann
committed by
Xisco Fauli
Xisco Fauli
parent
14312e4eb8
commit
1c0b50766a
@@ -25,8 +25,10 @@
|
||||
#include <optional>
|
||||
#include <span>
|
||||
|
||||
#include <rtl/ref.hxx>
|
||||
#include <svx/sdr/properties/properties.hxx>
|
||||
#include <svx/svxdllapi.h>
|
||||
#include <svl/itempool.hxx>
|
||||
#include <svl/itemset.hxx>
|
||||
|
||||
struct _xmlTextWriter;
|
||||
@@ -36,6 +38,9 @@ namespace sdr::properties
|
||||
{
|
||||
class SVXCORE_DLLPUBLIC DefaultProperties : public BaseProperties
|
||||
{
|
||||
// Make sure the pool outlives any use via moItemSet:
|
||||
rtl::Reference<SfxItemPool> m_itemPoolHolder;
|
||||
|
||||
protected:
|
||||
// the to be used ItemSet
|
||||
mutable std::optional<SfxItemSet> moItemSet;
|
||||
|
||||
@@ -21,6 +21,7 @@
|
||||
|
||||
#include <svx/sdr/properties/defaultproperties.hxx>
|
||||
#include <sdr/properties/itemsettools.hxx>
|
||||
#include <svl/itempool.hxx>
|
||||
#include <svl/itemset.hxx>
|
||||
#include <svl/whiter.hxx>
|
||||
#include <vector>
|
||||
@@ -41,11 +42,13 @@ namespace sdr::properties
|
||||
|
||||
DefaultProperties::DefaultProperties(SdrObject& rObj)
|
||||
: BaseProperties(rObj)
|
||||
, m_itemPoolHolder(&rObj.getSdrModelFromSdrObject().GetItemPool())
|
||||
{
|
||||
}
|
||||
|
||||
DefaultProperties::DefaultProperties(const DefaultProperties& rProps, SdrObject& rObj)
|
||||
: BaseProperties(rObj)
|
||||
, m_itemPoolHolder(&rObj.getSdrModelFromSdrObject().GetItemPool())
|
||||
{
|
||||
if(!rProps.moItemSet)
|
||||
return;
|
||||
|
||||
Reference in New Issue
Block a user