Files
libreoffice/sd/source/ui/inc/PresentationViewShell.hxx
Caolán McNamara 582a73abd2 tdf#64711 pointer deleted out from under std::shared_ptr
the "end" call will close the shell, which is deleted directly so the local shared_ptr remains
pointed to something which is already deleted.

So:
a) Have activate return true/false to indicate the failure and require the caller to call
'end' in response to failure.
b) A bunch of stuff in the call-stack expects the ViewShell not to get deleted while they are
calling it, so additionally launch that 'end' to happen in the next event loop.

==2838867== Invalid read of size 8
==2838867==    at 0x32F4B83C: sd::ViewShellBase::GetDocShell() const (ViewShellBase.hxx:97)
==2838867==    by 0x335BBCFC: sd::ViewShell::GetDocSh() const (viewshel.cxx:1389)
==2838867==    by 0x3357CAC1: sd::PresentationViewShell::~PresentationViewShell() (presvish.cxx:73)
==2838867==    by 0x330AA34B: void __gnu_cxx::new_allocator<sd::PresentationViewShell>::destroy<sd::PresentationViewShell>(sd::PresentationViewShell*) (new_allocator.h:156)
==2838867==    by 0x330AA2DF: void std::allocator_traits<std::allocator<sd::PresentationViewShell> >::destroy<sd::PresentationViewShell>(std::allocator<sd::PresentationViewShell>&, sd::PresentationViewShell*) (alloc_traits.h:531)
==2838867==    by 0x330AA0BE: std::_Sp_counted_ptr_inplace<sd::PresentationViewShell, std::allocator<sd::PresentationViewShell>, (__gnu_cxx::_Lock_policy)2>::_M_dispose() (shared_ptr_base.h:560)
==2838867==    by 0x32D10D33: std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release() (shared_ptr_base.h:158)
==2838867==    by 0x32D10C79: std::__shared_count<(__gnu_cxx::_Lock_policy)2>::~__shared_count() (shared_ptr_base.h:733)
==2838867==    by 0x330A03BD: std::__shared_ptr<sd::PresentationViewShell, (__gnu_cxx::_Lock_policy)2>::~__shared_ptr() (shared_ptr_base.h:1183)
==2838867==    by 0x3309F847: std::shared_ptr<sd::PresentationViewShell>::~shared_ptr() (shared_ptr.h:121)
==2838867==    by 0x3320E1E8: sd::SlideShow::activate(sd::ViewShellBase&) (slideshow.cxx:999)
==2838867==    by 0x3357CF33: sd::PresentationViewShell::Activate(bool) (presvish.cxx:118)

==2838867==  Address 0x2fb5f320 is 256 bytes inside a block of size 272 free'd
==2838867==    at 0x483BEDD: operator delete(void*) (vg_replace_malloc.c:584)
==2838867==    by 0x33466537: sd::PresentationViewShellBase::~PresentationViewShellBase() (PresentationViewShellBase.cxx:82)
==2838867==    by 0x823076C: SfxViewFrame::ReleaseObjectShell_Impl() (viewfrm.cxx:1113)
==2838867==    by 0x8234B1C: SfxViewFrame::~SfxViewFrame() (viewfrm.cxx:1652)
==2838867==    by 0x8234FEB: SfxViewFrame::~SfxViewFrame() (viewfrm.cxx:1646)
==2838867==    by 0x8230D6C: SfxViewFrame::Close() (viewfrm.cxx:1165)
==2838867==    by 0x81E4217: SfxFrame::DoClose_Impl() (frame.cxx:142)
==2838867==    by 0x821709A: SfxBaseController::dispose() (sfxbasecontroller.cxx:982)
==2838867==    by 0x3337A59F: sd::DrawController::dispose() (DrawController.cxx:164)
==2838867==    by 0x6F35CC0: (anonymous namespace)::XFrameImpl::setComponent(com::sun::uno::Reference<com::sun::awt::XWindow> const&, com::sun::uno::Reference<com::sun::frame::XController> const&) (frame.cxx:1485)
==2838867==    by 0x6F3834E: (anonymous namespace)::XFrameImpl::close(unsigned char) (frame.cxx:1692)
==2838867==    by 0x81E3CFA: SfxFrame::DoClose() (frame.cxx:108)
==2838867==    by 0x823802C: SfxViewFrame::DoClose() (viewfrm.cxx:2525)
==2838867==    by 0x3320B971: sd::SlideShow::end() (slideshow.cxx:696)
==2838867==    by 0x3320E1C2: sd::SlideShow::activate(sd::ViewShellBase&) (slideshow.cxx:995)
==2838867==    by 0x3357CF33: sd::PresentationViewShell::Activate(bool) (presvish.cxx:118)

Change-Id: Ida91228b7584491c9a5dc9c0b3f76ce63218a92a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/103319
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
2020-09-25 09:57:10 +02:00

74 lines
2.5 KiB
C++

/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/*
* This file is part of the LibreOffice project.
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* This file incorporates work covered by the following license notice:
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed
* with this work for additional information regarding copyright
* ownership. The ASF licenses this file to you under the Apache
* License, Version 2.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.apache.org/licenses/LICENSE-2.0 .
*/
#ifndef INCLUDED_SD_SOURCE_UI_INC_PRESENTATIONVIEWSHELL_HXX
#define INCLUDED_SD_SOURCE_UI_INC_PRESENTATIONVIEWSHELL_HXX
#include "DrawViewShell.hxx"
namespace sd {
/** This view shell is responsible for showing the presentation of an
Impress document.
*/
class PresentationViewShell : public DrawViewShell
{
public:
SFX_DECL_INTERFACE( SD_IF_SDPRESVIEWSHELL )
private:
/// SfxInterface initializer.
static void InitInterface_Impl();
public:
PresentationViewShell( ViewShellBase& rViewShellBase, vcl::Window* pParentWindow, FrameView* pFrameView);
virtual ~PresentationViewShell() override;
/** This method is used by a simple class that passes some
arguments from the creator of the new view shell to the new view
shell object by waiting for its asynchronous creation.
@param pFrameView
The frame view that is typically used by the creating object and
that shall be shared by the created view shell.
*/
void FinishInitialization( FrameView* pFrameView );
virtual void Resize() override;
protected:
virtual VclPtr<SvxRuler> CreateHRuler(::sd::Window* pWin) override;
virtual VclPtr<SvxRuler> CreateVRuler(::sd::Window* pWin) override;
private:
::tools::Rectangle maOldVisArea;
ImplSVEvent* mnAbortSlideShowEvent;
virtual void Activate (bool bIsMDIActivate) override;
virtual void Paint (const ::tools::Rectangle& rRect, ::sd::Window* pWin) override;
DECL_LINK(AbortSlideShowHdl, void*, void);
};
} // end of namespace sd
#endif
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */