commit cf13e1ddef974fb929916a9a4a54f37188b10389
author Caolán McNamara <caolanm@redhat.com> Wed Jun 19 20:45:12 2019 +0100
committer Caolán McNamara <caolanm@redhat.com> Thu Jun 20 11:08:46 2019 +0200
tree 7c2a6440b339259f9295e124c00ab57cbabc7464
parent ef73fefd023372ec0157683ed9ab349ff551a67c

tdf#125982 a11y use-after-free of editengine

Change-Id: I467f0715b2e7e1e65faed19bd2a5e31939426bfd
Reviewed-on: https://gerrit.libreoffice.org/74378
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

sc/source/ui/Accessibility/AccessibleDocument.cxx

diff --git a/sc/source/ui/Accessibility/AccessibleDocument.cxx b/sc/source/ui/Accessibility/AccessibleDocument.cxx
index d6ccb9e..cac634524 100644
--- a/sc/source/ui/Accessibility/AccessibleDocument.cxx
+++ b/sc/source/ui/Accessibility/AccessibleDocument.cxx
@@ -1493,9 +1493,15 @@
            if (mxTempAcc.is())
            {
                if (mpTempAccEdit)
                {
                    mpTempAccEdit->LostFocus();

                mpTempAccEdit = nullptr;
                    // tdf#125982 a11y use-after-free of editengine by
                    // ScAccessibleEditObjectTextData living past the
                    // the editengine of the editview passed in above
                    // in ScAccEnterEditMode
                    mpTempAccEdit->dispose();
                    mpTempAccEdit = nullptr;
                }
                RemoveChild(mxTempAcc, true);
                if (mpAccessibleSpreadsheet.is() && mpViewShell && mpViewShell->IsActive())
                    mpAccessibleSpreadsheet->GotFocus();