Use weak reference to SfxObjectShell in SfxEventHint to avoid use-after-free

The events may be processed after the shell has been destroyed. This is
happening reliably after commit e2bfc34d146806a8f96be0cd2323d716f12cba4e
(Reimplement OleComponentNative_Impl to use IGlobalInterfaceTable,
2024-03-11) when controlling LibreOffice from external Java scripts; but
obviously, it could happen before as well.

Now SotObject inherits from cppu::OWeakObject, instead of SvRefBase.

Change-Id: I73a3531499a3068c801c98f40de39bdf8ad90b2b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164458
Tested-by: Mike Kaganski <mike.kaganski@collabora.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

3 files changed, 24 insertions, 24 deletions

diff --git a/sot/qa/cppunit/test_sot.cxx b/sot/qa/cppunit/test_sot.cxx
index fde0757fba42..76a4492001c1 100644
--- a/sot/qa/cppunit/test_sot.cxx
+++ b/sot/qa/cppunit/test_sot.cxx
@@ -32,10 +32,10 @@ namespace
     public:
         SotTest() {}
 
-        bool checkStream( const tools::SvRef<SotStorage> &xObjStor,
+        bool checkStream( const rtl::Reference<SotStorage> &xObjStor,
                           const OUString &rStreamName,
                           sal_uInt64 nSize );
-        bool checkStorage( const tools::SvRef<SotStorage> &xObjStor );
+        bool checkStorage(const rtl::Reference<SotStorage>& xObjStor);
 
         virtual bool load(const OUString &,
             const OUString &rURL, const OUString &,
@@ -52,7 +52,7 @@ namespace
         CPPUNIT_TEST_SUITE_END();
     };
 
-    bool SotTest::checkStream( const tools::SvRef<SotStorage> &xObjStor,
+    bool SotTest::checkStream( const rtl::Reference<SotStorage> &xObjStor,
                                const OUString &rStreamName,
                                sal_uInt64 nSize )
     {
@@ -62,7 +62,7 @@ namespace
             return true;
 
         {   // Read the data in one block
-            tools::SvRef<SotStorageStream> xStream( xObjStor->OpenSotStream( rStreamName ) );
+            rtl::Reference<SotStorageStream> xStream(xObjStor->OpenSotStream(rStreamName));
             xStream->Seek(0);
             sal_uInt64 nRemaining = xStream->GetSize() - xStream->Tell();
 
@@ -73,7 +73,7 @@ namespace
             nReadableSize = xStream->ReadBytes(static_cast<void *>(pData), nSize);
         }
         {   // Read the data backwards as well
-            tools::SvRef<SotStorageStream> xStream( xObjStor->OpenSotStream( rStreamName ) );
+            rtl::Reference<SotStorageStream> xStream(xObjStor->OpenSotStream(rStreamName));
             for( sal_uInt64 i = nReadableSize; i > 0; i-- )
             {
                 CPPUNIT_ASSERT_MESSAGE( "sot reading error", !xStream->GetError() );
@@ -89,7 +89,7 @@ namespace
         return true;
     }
 
-    bool SotTest::checkStorage( const tools::SvRef<SotStorage> &xObjStor )
+    bool SotTest::checkStorage(const rtl::Reference<SotStorage>& xObjStor)
     {
         SvStorageInfoList aInfoList;
         xObjStor->FillInfoList( &aInfoList );
@@ -98,7 +98,7 @@ namespace
         {
             if( rInfo.IsStorage() )
             {
-                tools::SvRef<SotStorage> xChild( xObjStor->OpenSotStorage( rInfo.GetName() ) );
+                rtl::Reference<SotStorage> xChild(xObjStor->OpenSotStorage(rInfo.GetName()));
                 checkStorage( xChild );
             }
             else if( rInfo.IsStream() )
@@ -113,7 +113,7 @@ namespace
         SfxFilterFlags, SotClipboardFormatId, unsigned int)
     {
         SvFileStream aStream(rURL, StreamMode::READ);
-        tools::SvRef<SotStorage> xObjStor = new SotStorage(aStream);
+        rtl::Reference<SotStorage> xObjStor = new SotStorage(aStream);
         if (!xObjStor.is() || xObjStor->GetError())
             return false;
 
@@ -132,12 +132,12 @@ namespace
         OUString aURL(
             m_directories.getURLFromSrc(u"/sot/qa/cppunit/data/pass/fdo84229-1.compound"));
         SvFileStream aStream(aURL, StreamMode::READ);
-        tools::SvRef<SotStorage> xObjStor = new SotStorage(aStream);
+        rtl::Reference<SotStorage> xObjStor = new SotStorage(aStream);
         CPPUNIT_ASSERT_MESSAGE("sot storage failed to open",
                                xObjStor.is());
         CPPUNIT_ASSERT_MESSAGE("sot storage failed to open",
                                !xObjStor->GetError());
-        tools::SvRef<SotStorageStream> xStream = xObjStor->OpenSotStream("Book");
+        rtl::Reference<SotStorageStream> xStream = xObjStor->OpenSotStream("Book");
         CPPUNIT_ASSERT_MESSAGE("stream failed to open",
                                xStream.is());
         CPPUNIT_ASSERT_MESSAGE("stream failed to open",
diff --git a/sot/source/base/object.cxx b/sot/source/base/object.cxx
index 98dd8ea064d6..403467bd781a 100644
--- a/sot/source/base/object.cxx
+++ b/sot/source/base/object.cxx
@@ -38,13 +38,13 @@ void SotObject::OwnerLock(bool bLock)
     if (bLock)
     {
         nOwnerLockCount++;
-        AddFirstRef();
+        acquire();
     }
     else if (nOwnerLockCount)
     {
         if (0 == --nOwnerLockCount)
             DoClose();
-        ReleaseRef();
+        release();
     }
 }
 
@@ -53,7 +53,7 @@ bool SotObject::DoClose()
     bool bRet = false;
     if (!bInClose)
     {
-        tools::SvRef<SotObject> xHoldAlive(this);
+        rtl::Reference<SotObject> xHoldAlive(this);
         bInClose = true;
         bRet = Close();
         bInClose = false;
diff --git a/sot/source/sdstor/storage.cxx b/sot/source/sdstor/storage.cxx
index eff6a4fdf650..766c339f497d 100644
--- a/sot/source/sdstor/storage.cxx
+++ b/sot/source/sdstor/storage.cxx
@@ -402,7 +402,7 @@ SotStorage::~SotStorage()
 std::unique_ptr<SvMemoryStream> SotStorage::CreateMemoryStream()
 {
     std::unique_ptr<SvMemoryStream> pStm(new SvMemoryStream( 0x8000, 0x8000 ));
-    tools::SvRef<SotStorage> aStg = new SotStorage( *pStm );
+    rtl::Reference<SotStorage> aStg = new SotStorage(*pStm);
     if( CopyTo( aStg.get() ) )
     {
         aStg->Commit();
@@ -529,10 +529,10 @@ bool SotStorage::Commit()
     return ERRCODE_NONE == GetError();
 }
 
-tools::SvRef<SotStorageStream> SotStorage::OpenSotStream( const OUString & rEleName,
+rtl::Reference<SotStorageStream> SotStorage::OpenSotStream(const OUString& rEleName,
                                               StreamMode nMode )
 {
-    tools::SvRef<SotStorageStream> pStm;
+    rtl::Reference<SotStorageStream> pStm;
     if( m_pOwnStg )
     {
         // enable full Ole patches,
@@ -540,7 +540,7 @@ tools::SvRef<SotStorageStream> SotStorage::OpenSotStream( const OUString & rEleN
         nMode |= StreamMode::SHARE_DENYALL;
         ErrCode nE = m_pOwnStg->GetError();
         BaseStorageStream * p = m_pOwnStg->OpenStream( rEleName, nMode );
-        pStm = new SotStorageStream( p );
+        pStm = new SotStorageStream(p);
 
         if( !nE )
             m_pOwnStg->ResetError(); // don't set error
@@ -553,7 +553,7 @@ tools::SvRef<SotStorageStream> SotStorage::OpenSotStream( const OUString & rEleN
     return pStm;
 }
 
-SotStorage * SotStorage::OpenSotStorage( const OUString & rEleName,
+rtl::Reference<SotStorage> SotStorage::OpenSotStorage( const OUString & rEleName,
                                          StreamMode nMode,
                                          bool transacted )
 {
@@ -564,7 +564,7 @@ SotStorage * SotStorage::OpenSotStorage( const OUString & rEleName,
         BaseStorage * p = m_pOwnStg->OpenStorage(rEleName, nMode, !transacted);
         if( p )
         {
-            SotStorage * pStor = new SotStorage( p );
+            rtl::Reference<SotStorage> pStor = new SotStorage( p );
             if( !nE )
                 m_pOwnStg->ResetError(); // don't set error
 
@@ -657,7 +657,7 @@ bool SotStorage::IsOLEStorage( SvStream* pStream )
     return Storage::IsStorageFile( pStream );
 }
 
-SotStorage* SotStorage::OpenOLEStorage( const css::uno::Reference < css::embed::XStorage >& xStorage,
+rtl::Reference<SotStorage> SotStorage::OpenOLEStorage( const css::uno::Reference < css::embed::XStorage >& xStorage,
                                         const OUString& rEleName, StreamMode nMode )
 {
     sal_Int32 nEleMode = embed::ElementModes::SEEKABLEREAD;
@@ -757,7 +757,7 @@ sal_Int32 SotStorage::GetVersion( const css::uno::Reference < css::embed::XStora
 
 namespace
 {
-    void traverse(const tools::SvRef<SotStorage>& rStorage, std::vector<unsigned char>& rBuf)
+    void traverse(const rtl::Reference<SotStorage>& rStorage, std::vector<unsigned char>& rBuf)
     {
         SvStorageInfoList infos;
 
@@ -768,14 +768,14 @@ namespace
             if (info.IsStream())
             {
                 // try to open and read all content
-                tools::SvRef<SotStorageStream> xStream(rStorage->OpenSotStream(info.GetName(), StreamMode::STD_READ));
+                rtl::Reference<SotStorageStream> xStream(rStorage->OpenSotStream(info.GetName(), StreamMode::STD_READ));
                 const size_t nSize = xStream->GetSize();
                 const size_t nRead = xStream->ReadBytes(rBuf.data(), nSize);
                 SAL_INFO("sot", "Read " << nRead << "bytes");
             }
             else if (info.IsStorage())
             {
-                tools::SvRef<SotStorage> xStorage(rStorage->OpenSotStorage(info.GetName(), StreamMode::STD_READ));
+                rtl::Reference<SotStorage> xStorage(rStorage->OpenSotStorage(info.GetName(), StreamMode::STD_READ));
 
                 // continue with children
                 traverse(xStorage, rBuf);
@@ -789,7 +789,7 @@ extern "C" SAL_DLLPUBLIC_EXPORT bool TestImportOLE2(SvStream &rStream)
     try
     {
         size_t nSize = rStream.remainingSize();
-        tools::SvRef<SotStorage> xRootStorage(new SotStorage(&rStream, false));
+        rtl::Reference<SotStorage> xRootStorage(new SotStorage(&rStream, false));
         std::vector<unsigned char> aTmpBuf(nSize);
         traverse(xRootStorage, aTmpBuf);
     }