extensions/source/propctrlr/controlfontdialog.cxx    |    3 +
 extensions/source/propctrlr/controlfontdialog.hxx    |    2 +
 extensions/source/propctrlr/fontdialog.cxx           |   37 +++++--------------
 extensions/source/propctrlr/fontdialog.hxx           |    3 +
 extensions/source/propctrlr/formcomponenthandler.cxx |    4 +-
 svl/source/items/itemset.cxx                         |   13 +++---
 6 files changed, 26 insertions(+), 36 deletions(-)

New commits:
commit 625fa07d3399eb85d8f4bf4bf9ae1d11532b477c
Author:     Armin Le Grand (allotropia) <armin.le.grand.ext...@allotropia.de>
AuthorDate: Mon Feb 12 17:44:15 2024 +0100
Commit:     Armin Le Grand <armin.le.gr...@me.com>
CommitDate: Tue Feb 13 16:54:34 2024 +0100

    ITEM: corrected error for SfxSetItem
    
    Secured usage of FontList in SvxFontListItem
    usage (a test)
    
    Change-Id: I412a7681b3ece4e5d3751165d4b566ccdf5b2da9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163257
    Tested-by: Jenkins
    Reviewed-by: Armin Le Grand <armin.le.gr...@me.com>

diff --git a/extensions/source/propctrlr/controlfontdialog.cxx 
b/extensions/source/propctrlr/controlfontdialog.cxx
index 3887190752d3..bc97c5f1f0c1 100644
--- a/extensions/source/propctrlr/controlfontdialog.cxx
+++ b/extensions/source/propctrlr/controlfontdialog.cxx
@@ -37,6 +37,7 @@ namespace pcr
 
     OControlFontDialog::OControlFontDialog(const Reference< XComponentContext 
>& _rxContext )
     : OGenericUnoDialog( _rxContext )
+    , maFontList(Application::GetDefaultDevice())
     {
         registerProperty(PROPERTY_INTROSPECTEDOBJECT, 
static_cast<sal_Int32>(OwnPropertyId::INTROSPECTEDOBJECT),
             PropertyAttribute::BOUND | PropertyAttribute::TRANSIENT,
@@ -111,7 +112,7 @@ namespace pcr
 
     std::unique_ptr<weld::DialogController> 
OControlFontDialog::createDialog(const css::uno::Reference<css::awt::XWindow>& 
rParent)
     {
-        ControlCharacterDialog::createItemSet(m_pFontItems, m_pItemPool);
+        ControlCharacterDialog::createItemSet(m_pFontItems, m_pItemPool, 
maFontList);
 
         OSL_ENSURE(m_xControlModel.is(), "OControlFontDialog::createDialog: no 
introspectee set!");
         if (m_xControlModel.is())
diff --git a/extensions/source/propctrlr/controlfontdialog.hxx 
b/extensions/source/propctrlr/controlfontdialog.hxx
index 63bbae359de6..29dd95d2192a 100644
--- a/extensions/source/propctrlr/controlfontdialog.hxx
+++ b/extensions/source/propctrlr/controlfontdialog.hxx
@@ -21,6 +21,7 @@
 
 #include <comphelper/proparrhlp.hxx>
 #include <svtools/genericunodialog.hxx>
+#include <svtools/ctrltool.hxx>
 
 class SfxItemSet;
 class SfxItemPool;
@@ -44,6 +45,7 @@ namespace pcr
 
         std::unique_ptr<SfxItemSet> m_pFontItems;       // item set for the 
dialog
         rtl::Reference<SfxItemPool> m_pItemPool;            // item pool for 
the item set for the dialog
+        FontList maFontList;
 
     public:
         explicit OControlFontDialog(const css::uno::Reference< 
css::uno::XComponentContext >& _rxContext);
diff --git a/extensions/source/propctrlr/fontdialog.cxx 
b/extensions/source/propctrlr/fontdialog.cxx
index 17401748f67a..c84f13f9047d 100644
--- a/extensions/source/propctrlr/fontdialog.cxx
+++ b/extensions/source/propctrlr/fontdialog.cxx
@@ -529,24 +529,7 @@ namespace pcr
 
         public:
             virtual size_t size() const override { return maItemInfos.size(); }
-            virtual const ItemInfo& getItemInfo(size_t nIndex, SfxItemPool& 
/*rPool*/) override
-            {
-                const ItemInfo& rRetval(maItemInfos[nIndex]);
-
-                // return immediately if we have the static entry and Item
-                if (nullptr != rRetval.getItem())
-                    return rRetval;
-
-                // check for dynamic ItemInfo creation, needed here for 
FontList.
-                // this will be deleted when the Pool where it gets used goes 
down,
-                // thus may happen multiple times. ownership will be at the 
pool.
-                if (FontItemIds::CFID_FONTLIST == rRetval.getWhich())
-                    return *new ItemInfoDynamic(
-                        rRetval,
-                        new SvxFontListItem(new 
FontList(Application::GetDefaultDevice()), FontItemIds::CFID_FONTLIST));
-
-                return rRetval;
-            }
+            virtual const ItemInfo& getItemInfo(size_t nIndex, SfxItemPool& 
/*rPool*/) override { return maItemInfos[nIndex]; }
         };
 
         static std::unique_ptr<ItemInfoPackageCntChrDlg> 
g_aItemInfoPackageCntChrDlg;
@@ -555,13 +538,21 @@ namespace pcr
         return *g_aItemInfoPackageCntChrDlg;
     }
 
-    void ControlCharacterDialog::createItemSet(std::unique_ptr<SfxItemSet>& 
_rpSet, rtl::Reference<SfxItemPool>& _rpPool)
+    void ControlCharacterDialog::createItemSet(std::unique_ptr<SfxItemSet>& 
_rpSet, rtl::Reference<SfxItemPool>& _rpPool, FontList& rFontList)
     {
         // just to be sure...
         _rpSet = nullptr;
         _rpPool = nullptr;
         _rpPool = new SfxItemPool("PCRControlFontItemPool");
-        _rpPool->registerItemInfoPackage(getItemInfoPackageCntChrDlg());
+        _rpPool->registerItemInfoPackage(
+            getItemInfoPackageCntChrDlg(),
+            [&rFontList](sal_uInt16 nWhich)
+            {
+                SfxPoolItem* pRetval(nullptr);
+                if (FontItemIds::CFID_FONTLIST == nWhich)
+                    pRetval = new SvxFontListItem(&rFontList, 
FontItemIds::CFID_FONTLIST);
+                return pRetval;
+            });
 
         // and, finally, the set
         _rpSet.reset(new SfxItemSet(*_rpPool));
@@ -569,17 +560,11 @@ namespace pcr
 
     void ControlCharacterDialog::destroyItemSet(std::unique_ptr<SfxItemSet>& 
_rpSet, rtl::Reference<SfxItemPool>& _rpPool)
     {
-        // from the pool, get and remember the font list (needs to be deleted)
-        const SvxFontListItem& rFontListItem = static_cast<const 
SvxFontListItem&>(_rpPool->GetUserOrPoolDefaultItem(FontItemIds::CFID_FONTLIST));
-        const FontList* pFontList = rFontListItem.GetFontList();
-
         // _first_ delete the set (referring the pool)
         _rpSet.reset();
 
         // delete the pool
         _rpPool = nullptr;
-
-        delete pFontList;
     }
 
     void ControlCharacterDialog::PageCreated(const OUString& rId, SfxTabPage& 
rPage)
diff --git a/extensions/source/propctrlr/fontdialog.hxx 
b/extensions/source/propctrlr/fontdialog.hxx
index de184df5e841..07d72a600f4d 100644
--- a/extensions/source/propctrlr/fontdialog.hxx
+++ b/extensions/source/propctrlr/fontdialog.hxx
@@ -22,6 +22,7 @@
 #include <sfx2/tabdlg.hxx>
 #include <com/sun/star/beans/XPropertySet.hpp>
 #include <com/sun/star/beans/NamedValue.hpp>
+#include <svtools/ctrltool.hxx>
 
 
 namespace pcr
@@ -36,7 +37,7 @@ namespace pcr
         virtual ~ControlCharacterDialog() override;
 
         /// creates an item set to be used with this dialog
-        static void         createItemSet(std::unique_ptr<SfxItemSet>& _rpSet, 
rtl::Reference<SfxItemPool>& _rpPool);
+        static void         createItemSet(std::unique_ptr<SfxItemSet>& _rpSet, 
rtl::Reference<SfxItemPool>& _rpPool, FontList& rFontList);
 
         /// destroys an item previously created with 
<method>createItemSet</method>
         static void         destroyItemSet(std::unique_ptr<SfxItemSet>& 
_rpSet, rtl::Reference<SfxItemPool>& _rpPool);
diff --git a/extensions/source/propctrlr/formcomponenthandler.cxx 
b/extensions/source/propctrlr/formcomponenthandler.cxx
index 9527da83298f..24ea0c6dd7ef 100644
--- a/extensions/source/propctrlr/formcomponenthandler.cxx
+++ b/extensions/source/propctrlr/formcomponenthandler.cxx
@@ -103,6 +103,7 @@
 #include <comphelper/diagnose_ex.hxx>
 #include <sal/macros.h>
 #include <sal/log.hxx>
+#include <vcl/svapp.hxx>
 
 #include <limits>
 #include <memory>
@@ -2834,7 +2835,8 @@ namespace pcr
         // create an item set for use with the dialog
         std::unique_ptr<SfxItemSet> pSet;
         rtl::Reference<SfxItemPool> pPool;
-        ControlCharacterDialog::createItemSet(pSet, pPool);
+        FontList aFontList(Application::GetDefaultDevice());
+        ControlCharacterDialog::createItemSet(pSet, pPool, aFontList);
         ControlCharacterDialog::translatePropertiesToItems(m_xComponent, 
pSet.get());
 
         {   // do this in an own block. The dialog needs to be destroyed 
before we call
diff --git a/svl/source/items/itemset.cxx b/svl/source/items/itemset.cxx
index b01b0d54519e..05ba5672a02c 100644
--- a/svl/source/items/itemset.cxx
+++ b/svl/source/items/itemset.cxx
@@ -499,13 +499,12 @@ SfxPoolItem const* implCreateItemEntry(SfxItemPool& 
rPool, SfxPoolItem const* pS
         // static default Items can just be used without RefCounting
         return pSource;
 
-    if (pSource->isDynamicDefault() && !pSource->isSetItem())
-    {
-        // dynamic default Items can only be used without RefCounting
-        // when same pool, else it has to be cloned (below)
-        if (static_cast<const SfxSetItem*>(pSource)->GetItemSet().GetPool() == 
&rPool)
-            return pSource;
-    }
+    if (pSource->isDynamicDefault()
+        && pSource->isSetItem()
+        && static_cast<const SfxSetItem*>(pSource)->GetItemSet().GetPool() == 
&rPool)
+        // only use without RefCounting when SfxSetItem and the Pool is 
correct.
+        // all other cases just clone (as before)
+        return pSource;
 
     if (0 == pSource->Which())
     {

Reply via email to