sc/source/ui/Accessibility/AccessibleDocument.cxx | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
New commits:
commit cf13e1ddef974fb929916a9a4a54f37188b10389
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Wed Jun 19 20:45:12 2019 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Thu Jun 20 11:08:46 2019 +0200
tdf#125982 a11y use-after-free of editengine
Change-Id: I467f0715b2e7e1e65faed19bd2a5e31939426bfd
Reviewed-on: https://gerrit.libreoffice.org/74378
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sc/source/ui/Accessibility/AccessibleDocument.cxx
b/sc/source/ui/Accessibility/AccessibleDocument.cxx
index d6ccb9ea32cc..cac634524832 100644
--- a/sc/source/ui/Accessibility/AccessibleDocument.cxx
+++ b/sc/source/ui/Accessibility/AccessibleDocument.cxx
@@ -1493,9 +1493,15 @@ void ScAccessibleDocument::Notify( SfxBroadcaster& rBC,
const SfxHint& rHint )
if (mxTempAcc.is())
{
if (mpTempAccEdit)
+ {
mpTempAccEdit->LostFocus();
-
- mpTempAccEdit = nullptr;
+ // tdf#125982 a11y use-after-free of editengine by
+ // ScAccessibleEditObjectTextData living past the
+ // the editengine of the editview passed in above
+ // in ScAccEnterEditMode
+ mpTempAccEdit->dispose();
+ mpTempAccEdit = nullptr;
+ }
RemoveChild(mxTempAcc, true);
if (mpAccessibleSpreadsheet.is() && mpViewShell &&
mpViewShell->IsActive())
mpAccessibleSpreadsheet->GotFocus();
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
