Files
odfstudio/svx
Stephan Bergmann 1c0b50766a Fix heap-use-after-free
...as seen once during JunitTest_forms_complex,

> ==2007790==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ccbfe8b3a38 at pc 0x7f5c5361ed51 bp 0x7b5bd4ac7420 sp 0x7b5bd4ac7418
> READ of size 2 at 0x7ccbfe8b3a38 thread T8
>  #0 in SfxItemPool::IsInRange(unsigned short) const at engine/include/svl/itempool.hxx:331:66
>  #1 in SfxItemPool::getTargetPool(unsigned short) const at engine/svl/source/items/itempool.cxx:452:9
>  #2 in SfxItemPool::CheckItemInfoFlag(unsigned short, unsigned short) const at engine/svl/source/items/itempool.cxx:461:26
>  #3 in SfxItemPool::NeedsSurrogateSupport(unsigned short) const at engine/include/svl/itempool.hxx:343:18
>  #4 in SfxItemSet::checkRemovePoolRegistration(SfxPoolItem const*) at engine/svl/source/items/itemset.cxx:384:20
>  #5 in SfxItemSet::ClearSingleItem_PrepareRemove(SfxPoolItem const*) at engine/svl/source/items/itemset.cxx:364:5
>  #6 in SfxItemSet::ClearAllItemsImpl() at engine/svl/source/items/itemset.cxx:443:9
>  #7 in SfxItemSet::~SfxItemSet() at engine/svl/source/items/itemset.cxx:318:5
>  #8 in std::_Optional_payload_base<SfxItemSet>::_M_destroy() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:305:23
>  #9 in std::_Optional_payload_base<SfxItemSet>::_M_reset() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:341:4
>  #10 in std::_Optional_payload<SfxItemSet, false, false, false>::~_Optional_payload() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:464:57
>  #11 in std::_Optional_base<SfxItemSet, false, false>::~_Optional_base() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:488:12
>  #12 in std::optional<SfxItemSet>::~optional() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/optional:781:11
>  #13 in sdr::properties::DefaultProperties::~DefaultProperties() at engine/svx/source/sdr/properties/defaultproperties.cxx:92:50
>  #14 in sdr::properties::AttributeProperties::~AttributeProperties() at engine/svx/source/sdr/properties/attributeproperties.cxx:221:9
>  #15 in sdr::properties::TextProperties::~TextProperties() at engine/svx/source/sdr/properties/textproperties.cxx:79:9
>  #16 in sdr::properties::RectangleProperties::~RectangleProperties() at engine/svx/source/sdr/properties/rectangleproperties.cxx:38:9
>  #17 in sdr::properties::RectangleProperties::~RectangleProperties() at engine/svx/source/sdr/properties/rectangleproperties.cxx:37:9
>  #18 in std::default_delete<sdr::properties::BaseProperties>::operator()(sdr::properties::BaseProperties*) const at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/unique_ptr.h:92:2
>  #19 in std::__uniq_ptr_impl<sdr::properties::BaseProperties, std::default_delete<sdr::properties::BaseProperties>>::reset(sdr::properties::BaseProperties*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/unique_ptr.h:204:4
>  #20 in std::unique_ptr<sdr::properties::BaseProperties, std::default_delete<sdr::properties::BaseProperties>>::reset(sdr::properties::BaseProperties*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/unique_ptr.h:530:7
>  #21 in SdrObject::~SdrObject() at engine/svx/source/svdraw/svdobj.cxx:589:18
>  #22 in SdrAttrObj::~SdrAttrObj() at engine/svx/source/svdraw/svdoattr.cxx:42:28
>  #23 in SdrTextObj::~SdrTextObj() at engine/svx/source/svdraw/svdotext.cxx:156:1
>  #24 in SdrRectObj::~SdrRectObj() at engine/svx/source/svdraw/svdorect.cxx:69:25
>  #25 in SdrUnoObj::~SdrUnoObj() at engine/svx/source/svdraw/svdouno.cxx:223:1
>  #26 in FmFormObj::~FmFormObj() at engine/svx/source/form/fmobj.cxx:120:1
>  #27 in FmFormObj::~FmFormObj() at engine/svx/source/form/fmobj.cxx:113:1
>  #28 in SdrObject::release() at engine/svx/source/svdraw/svdobj.cxx:612:9
>  #29 in rtl::Reference<SdrObject>::clear() at engine/include/rtl/ref.hxx:181:19
>  #30 in SvxShape::~SvxShape() at engine/svx/source/unodraw/unoshape.cxx:199:21
>  #31 in SvxShapeText::~SvxShapeText() at engine/svx/source/unodraw/unoshape.cxx:3828:1
>  #32 in SvxShapeControl::~SvxShapeControl() at engine/svx/source/unodraw/unoshap2.cxx:393:1
>  #33 in SvxShapeControl::~SvxShapeControl() at engine/svx/source/unodraw/unoshap2.cxx:392:1
>  #34 in cppu::OWeakObject::release() at engine/cppuhelper/source/weak.cxx:231:9
>  #35 in cppu::OWeakAggObject::release() at engine/cppuhelper/source/weak.cxx:293:22
>  #36 in cppu::WeakAggImplHelper12<com::sun::star::drawing::XShape, com::sun::star::lang::XComponent, com::sun::star::beans::XPropertySet, com::sun::star::beans::XMultiPropertySet, com::sun::star::beans::XPropertyState, com::sun::star::lang::XUnoTunnel, com::sun::star::container::XNamed, com::sun::star::drawing::XGluePointsSupplier, com::sun::star::container::XChild, com::sun::star::lang::XServiceInfo, com::sun::star::document::XActionLockable, com::sun::star::beans::XMultiPropertyStates>::release() at engine/include/cppuhelper/implbase12.hxx:161:31
>  #37 in SvxShapeText::release() at engine/include/svx/unoshape.hxx:357:17
>  #38 in SvxShapeControl::release() at engine/include/svx/unoshape.hxx:508:21
>  #39 in freeUnoInterfaceProxy at engine/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:42:19
>  #40 in (anonymous namespace)::s_stub_defenv_revokeInterface(__va_list_tag (*) [1]) at engine/cppu/source/uno/lbenv.cxx:369:17
>  #41 in s_environment_invoke_v(_uno_Environment*, _uno_Environment*, void (*)(__va_list_tag (*) [1]), __va_list_tag (*) [1]) at engine/cppu/source/uno/EnvStack.cxx:292:9
>  #42 in uno_Environment_invoke_v at engine/cppu/source/uno/EnvStack.cxx:310:5
>  #43 in uno_Environment_invoke at engine/cppu/source/uno/EnvStack.cxx:318:5
>  #44 in (anonymous namespace)::defenv_revokeInterface(_uno_ExtEnvironment*, void*) at engine/cppu/source/uno/lbenv.cxx:423:5
>  #45 in releaseProxy at engine/bridges/source/cpp_uno/shared/unointerfaceproxy.cxx:78:9
>  #46 in com::sun::star::uno::UnoInterfaceReference::~UnoInterfaceReference() at engine/include/uno/dispatcher.hxx:93:9
>  #47 in binaryurp::Bridge::releaseStub(rtl::OUString const&, com::sun::star::uno::TypeDescription const&) at engine/binaryurp/source/bridge.cxx:509:1
>  #48 in binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny*, std::__debug::vector<binaryurp::BinaryAny, std::allocator<binaryurp::BinaryAny>>*) const at engine/binaryurp/source/incomingrequest.cxx:138:18
>  #49 in binaryurp::IncomingRequest::execute() const at engine/binaryurp/source/incomingrequest.cxx:79:26
>  #50 in request at engine/binaryurp/source/reader.cxx:86:9
>  #51 in cppu_threadpool::JobQueue::enter(void const*, bool) at engine/cppu/source/threadpool/jobqueue.cxx:100:17
>  #52 in cppu_threadpool::ORequestThread::run() at engine/cppu/source/threadpool/thread.cxx:165:31
>  #53 in threadFunc at engine/include/osl/thread.hxx:175:15
>  #54 in osl_thread_start_Impl(void*) at engine/sal/osl/unx/thread.cxx:240:9
>
> 0x7ccbfe8b3a38 is located 184 bytes inside of 648-byte region [0x7ccbfe8b3980,0x7ccbfe8b3c08)
> freed by thread T23 here:
>  #0 in operator delete(void*, unsigned long) at ~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:187:3
>  #1 in SdrItemPool::~SdrItemPool() at engine/svx/source/svdraw/svdattr.cxx:514:1
>  #2 in salhelper::SimpleReferenceObject::release() at engine/include/salhelper/simplereferenceobject.hxx:61:13
>  #3 in rtl::Reference<SfxItemPool>::~Reference() at engine/include/rtl/ref.hxx:116:22
>  #4 in SdrModel::~SdrModel() at engine/svx/source/svdraw/svdmodel.cxx:275:1
>  #5 in FmFormModel::~FmFormModel() at engine/svx/source/form/fmmodel.cxx:69:1
>  #6 in SdDrawDocument::~SdDrawDocument() at engine/sd/source/core/drawdoc.cxx:418:1
>  #7 in sd::DrawDocShell::~DrawDocShell() at engine/sd/source/ui/docshell/docshell.cxx:192:9
>  #8 in sd::GraphicDocShell::~GraphicDocShell() at engine/sd/source/ui/docshell/grdocsh.cxx:57:38
>  #9 in sd::GraphicDocShell::~GraphicDocShell() at engine/sd/source/ui/docshell/grdocsh.cxx:57:37
>  #10 in cppu::OWeakObject::release() at engine/cppuhelper/source/weak.cxx:231:9
>  #11 in rtl::Reference<SfxObjectShell>::~Reference() at engine/include/rtl/ref.hxx:116:22
>  #12 in IMPL_SfxBaseModel_DataContainer::~IMPL_SfxBaseModel_DataContainer() at engine/sfx2/source/doc/sfxbasemodel.cxx:268:5
>  #13 in void std::destroy_at<IMPL_SfxBaseModel_DataContainer>(IMPL_SfxBaseModel_DataContainer*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/stl_construct.h:88:15
>  #14 in void std::_Destroy<IMPL_SfxBaseModel_DataContainer>(IMPL_SfxBaseModel_DataContainer*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/stl_construct.h:164:7
>  #15 in void std::allocator_traits<std::allocator<void>>::destroy<IMPL_SfxBaseModel_DataContainer>(std::allocator<void>&, IMPL_SfxBaseModel_DataContainer*) at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/alloc_traits.h:863:4
>  #16 in std::_Sp_counted_ptr_inplace<IMPL_SfxBaseModel_DataContainer, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:650:2
>  #17 in std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:423:8
>  #18 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:1100:11
>  #19 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:1574:31
>  #20 in std::__shared_ptr<IMPL_SfxBaseModel_DataContainer, (__gnu_cxx::_Lock_policy)2>::reset() at ~/gcc/inst/lib/gcc/x86_64-pc-linux-gnu/17.0.0/../../../../include/c++/17.0.0/bits/shared_ptr_base.h:1692:9
>  #21 in SfxBaseModel::dispose() at engine/sfx2/source/doc/sfxbasemodel.cxx:802:13
>  #22 in SdXImpressDocument::dispose() at engine/sd/source/ui/unoidl/unomodel.cxx:5515:19
>  #23 in SfxBaseModel::close(bool) at engine/sfx2/source/doc/sfxbasemodel.cxx:1544:5
>  #24 in gcc3::callVirtualMethod(void*, unsigned int, void*, _typelib_TypeDescriptionReference*, bool, unsigned long*, unsigned int, unsigned long*, double*) at engine/bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:87:5
>  #25 in cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy*, bridges::cpp_uno::shared::VtableSlot, _typelib_TypeDescriptionReference*, int, _typelib_MethodParameter*, void*, void**, _uno_Any**) at engine/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:230:13
>  #26 in unoInterfaceProxyDispatch at engine/bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:410:13
>  #27 in binaryurp::IncomingRequest::execute_throw(binaryurp::BinaryAny*, std::__debug::vector<binaryurp::BinaryAny, std::allocator<binaryurp::BinaryAny>>*) const at engine/binaryurp/source/incomingrequest.cxx:236:13
>  #28 in binaryurp::IncomingRequest::execute() const at engine/binaryurp/source/incomingrequest.cxx:79:26
>  #29 in request at engine/binaryurp/source/reader.cxx:86:9
>  #30 in cppu_threadpool::JobQueue::enter(void const*, bool) at engine/cppu/source/threadpool/jobqueue.cxx:100:17
>  #31 in cppu_threadpool::ORequestThread::run() at engine/cppu/source/threadpool/thread.cxx:165:31
>  #32 in threadFunc at engine/include/osl/thread.hxx:175:15
>  #33 in osl_thread_start_Impl(void*) at engine/sal/osl/unx/thread.cxx:240:9

Change-Id: Ib38eb730f9178976d4432f77857b4f09ebfbdbcf
Signed-off-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6296
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 7a151cb95d66be93ef2a2687d1ff55ca37daa410)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211728
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
2026-10-05 08:52:33 +02:00
..
…
2026-10-05 08:52:04 +02:00
2026-10-05 08:52:33 +02:00
…
…
2026-05-29 13:38:32 +02:00

Graphics Related Helper Code

Contains graphics related helper code. Lots of the draw and impress code is in this shared library.

  • xoutdev

    this is where a lot of the work would happen to move to the canvas. (what does that mean?)

  • svdraw

    transparent gradient stuff. [seriously? surely much more, too]

SdrObject

The shapes you can see in LibreOffice (like rectangle, etc.) are SdrObjects. They are declared as a hierarchy:

SdrObject <- SdrAttrObj <- E3dObject <- E3dCompoundObject <- E3dCubeObj
    ^ ^ ^             ^            ^              | | ^ ^
    | | |             |            |              | | | +--- E3dExtrudeObj
    | | |             |            |              | | +----- E3dLatheObj
    | | |             |            |              | +------- E3dPolygonObj
    | | |             |            |              +--------- E3dSphereObj
    | | |             |            +--- E3dScene...
    | | |             |
    | | |             +--- SdrTextObj <- SdrObjCustomShape...
    | | |                   ^ ^ ^ ^ ^
    | | |                   | | | | +--- SdrEdgeObj...
    | | |                   | | | +----- SdrMeasureObj...
    | | |                   | | +------- SdrPathObj...
    | | |                   | +--------- SdrRectObj...
    | | |                   +----------- SdrTableObj...
    | | +--- SdrObjGroup...
    | + ---- SdrPageObj...
    +------- SdrVirtObj...

The above is incomplete of course.

SdrModel / SdrView

Copied from svdview.hxx:

First of all the app creates a SdrModel. Then it opens a Win and creates a SdrView. ShowSdrPage() announces a page at SdrView. It's possible to show SdrView in any Wins at once.

SdrView can show as many Wins as it wants at once. Pages are announced or checked out with the help of ShowSdrPage()/HideSdrPage(). For every announced page there is a SdrPageView instance in container aPages. If more than one page is showed, you have to pay attention that the offset parameter of ShowSdrPage() is conformed to the size of the page (to prevent overlapping of two pages).

SdrView itself is inherited from many objects in a chain of inheritance (all that starts with SdrPaintView - that is itself inherited from few classes too):

SdrPaintView <- SdrSnapView <- SdrMarkView <- SdrEditView <- SdrPolyEditView
                                                                 ^
+----------------------------------------------------------------+
|
SdrGlueEditView <- SdrObjEditView <- SdrExchangeView <- SdrDragView
                                                                 ^
+----------------------------------------------------------------+
|
SdrCreateView <- SdrView

From SdrView on, it is not flat, but a real hierarchy again.

Drawing Layer / SdrObject(s)

See drawinglayer/README.md for general information about drawinglayer.

Below is the class diagram that comes from https://web.archive.org/web/20160827020830if_/http://www.openoffice.org:80/marketing/ooocon2006/presentations/wednesday_g11.odp slide number 6.

.------- Model --------------.      .------- View -----------------------------------------.
| SdrObject - ViewContact    | 1..* | ViewObjectContact                                    |
|              getChild()    |------|    getPrimitiveList()  -----> Object(s) ---> SdrView |
|              getVOC()      |      |    getRecPrimitiveList()      Contact                |
|              getViewInd... |      |________|_____________________________________________|
| ...ependentPrimitiveList() |               |
|____________________________|            generates
                                             |           ______
                                             V          /      |
                                   .----------------------.    |
                                   | basePrimitive        |    |
                                   |   getRange()         |<---'
                                   |   getDecomposition() |
                                   |______________________|

For SdrObjects, there are own DrawingLayer primitives in svx/source/sdr/primitive2d

The ViewContact / ViewObject / ViewObjectContact are in svx/source/sdr/contact Decomposes the SdrObjects, and does all sort of operations on them.

If the number of visualizable objects (e.g. SdrObjects) is X, and the number of SdrViews is Y, then:

  • there are X ViewContact instances (1:1 relation with a visualizable object)
  • there are Y ObjectContact instances (1:1 relation with an SdrView)
  • there are X*Y ViewObjectContact instances (1:N relation to both visualizable objects and SdrViews)