sc/source/ui/Accessibility/AccessibleDocument.cxx | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
New commits:
commit b4e1b145ff9cccd4d91798c5da2e32ffa9b267ec
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Wed Jun 19 20:45:12 2019 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Thu Jun 20 16:15:16 2019 +0200
tdf#125982 a11y use-after-free of editengine
Change-Id: I467f0715b2e7e1e65faed19bd2a5e31939426bfd
Reviewed-on: https://gerrit.libreoffice.org/74429
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
Tested-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sc/source/ui/Accessibility/AccessibleDocument.cxx
b/sc/source/ui/Accessibility/AccessibleDocument.cxx
index 565de0e65fec..f9ea7367a6bb 100644
--- a/sc/source/ui/Accessibility/AccessibleDocument.cxx
+++ b/sc/source/ui/Accessibility/AccessibleDocument.cxx
@@ -1493,9 +1493,15 @@ void ScAccessibleDocument::Notify( SfxBroadcaster& rBC,
const SfxHint& rHint )
if (mxTempAcc.is())
{
if (mpTempAccEdit)
+ {
mpTempAccEdit->LostFocus();
-
- mpTempAccEdit = nullptr;
+ // tdf#125982 a11y use-after-free of editengine by
+ // ScAccessibleEditObjectTextData living past the
+ // the editengine of the editview passed in above
+ // in ScAccEnterEditMode
+ mpTempAccEdit->dispose();
+ mpTempAccEdit = nullptr;
+ }
RemoveChild(mxTempAcc, true);
if (mpAccessibleSpreadsheet.is() && mpViewShell &&
mpViewShell->IsActive())
mpAccessibleSpreadsheet->GotFocus();
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
