https://bugs.documentfoundation.org/show_bug.cgi?id=174316
Bug ID: 174316
Summary: svl: SharedString self-move assignment causes
heap-use-after-free
Product: LibreOffice
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: LibreOffice
Assignee: [email protected]
Reporter: [email protected]
Description:
`svl::SharedString::operator=(SharedString&&)` does not handle self-move
assignment.
When an object is move-assigned to itself, the operator can release the last
reference to its string data and then restore the freed pointer. Accessing the
string afterward causes a heap-use-after-free.
The issue was found during source code analysis. I have not found a way to
trigger it through the LibreOffice UI or by opening a document.
A fix and a CppUnit regression test have been submitted for review:
https://gerrit.libreoffice.org/c/core/+/213386
Steps to Reproduce:
1. Build the attached standalone C++ reproducer using `./build.sh`.
2. Run `./run.sh`.
3. The test performs self-move assignment (`string = std::move(string)`) and
then calls `string.getLength()`.
The standalone reproducer uses the original LibreOffice SharedString
implementation with a minimal SAL reference-counting shim.
Actual Results:
AddressSanitizer reports `heap-use-after-free` in
`svl::SharedString::getLength()`, after the memory was freed in the
move-assignment operator.
Expected Results:
Self-move assignment should leave the object in a valid state without dangling
pointers.
Reproducible: Always
User Profile Reset: No
Additional Info:
- Affected code: `include/svl/sharedstring.hxx`, lines 93–105.
- Reproduced with the original LibreOffice source under AddressSanitizer.
- Tested on macOS ARM64 with Apple Clang 21.
- Source revision: `7528c0d406012e10c6ce34c3f24bf277302ec695`.
--
You are receiving this mail because:
You are the assignee for the bug.
