Use weak reference to SfxObjectShell in SfxEventHint to avoid use-after-free

The events may be processed after the shell has been destroyed. This is
happening reliably after commit e2bfc34d146806a8f96be0cd2323d716f12cba4e
(Reimplement OleComponentNative_Impl to use IGlobalInterfaceTable,
2024-03-11) when controlling LibreOffice from external Java scripts; but
obviously, it could happen before as well.

Now SotObject inherits from cppu::OWeakObject, instead of SvRefBase.

Change-Id: I73a3531499a3068c801c98f40de39bdf8ad90b2b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164458
Tested-by: Mike Kaganski <mike.kaganski@collabora.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

2 files changed, 15 insertions, 15 deletions

diff --git a/writerperfect/inc/WPXSvInputStream.hxx b/writerperfect/inc/WPXSvInputStream.hxx
index 66ed90a958b4..b7e6a7a04484 100644
--- a/writerperfect/inc/WPXSvInputStream.hxx
+++ b/writerperfect/inc/WPXSvInputStream.hxx
@@ -57,7 +57,7 @@ private:
     bool isZip();
     void ensureZipIsInitialized();
     static librevenge::RVNGInputStream*
-    createWPXStream(const tools::SvRef<SotStorageStream>& rxStorage);
+    createWPXStream(const rtl::Reference<SotStorageStream>& rxStorage);
     static librevenge::RVNGInputStream*
     createWPXStream(const css::uno::Reference<css::io::XInputStream>& rxStream);
 
diff --git a/writerperfect/source/common/WPXSvInputStream.cxx b/writerperfect/source/common/WPXSvInputStream.cxx
index dee82500dea3..ee975584edcf 100644
--- a/writerperfect/source/common/WPXSvInputStream.cxx
+++ b/writerperfect/source/common/WPXSvInputStream.cxx
@@ -96,7 +96,7 @@ struct OLEStreamData
     {
     }
 
-    tools::SvRef<SotStorageStream> stream;
+    rtl::Reference<SotStorageStream> stream;
 
     /** Name of the stream.
       *
@@ -114,7 +114,7 @@ struct OLEStreamData
 } // anonymous namespace
 
 typedef std::unordered_map<OUString, std::size_t> NameMap_t;
-typedef std::unordered_map<OUString, tools::SvRef<SotStorage>> OLEStorageMap_t;
+typedef std::unordered_map<OUString, rtl::Reference<SotStorage>> OLEStorageMap_t;
 
 /** Representation of an OLE2 storage.
   *
@@ -138,16 +138,16 @@ struct OLEStorageImpl
 
     void initialize(std::unique_ptr<SvStream> pStream);
 
-    tools::SvRef<SotStorageStream> getStream(const OUString& rPath);
-    tools::SvRef<SotStorageStream> const& getStream(std::size_t nId);
+    rtl::Reference<SotStorageStream> getStream(const OUString& rPath);
+    rtl::Reference<SotStorageStream> const& getStream(std::size_t nId);
 
 private:
-    void traverse(const tools::SvRef<SotStorage>& rStorage, std::u16string_view rPath);
+    void traverse(const rtl::Reference<SotStorage>& rStorage, std::u16string_view rPath);
 
-    tools::SvRef<SotStorageStream> createStream(const OUString& rPath);
+    rtl::Reference<SotStorageStream> createStream(const OUString& rPath);
 
 public:
-    tools::SvRef<SotStorage> mxRootStorage; //< root storage of the OLE2
+    rtl::Reference<SotStorage> mxRootStorage; //< root storage of the OLE2
     OLEStorageMap_t maStorageMap; //< map of all sub storages by name
     ::std::vector<OLEStreamData> maStreams; //< list of streams and their names
     NameMap_t maNameMap; //< map of stream names to indexes (into @c maStreams)
@@ -171,7 +171,7 @@ void OLEStorageImpl::initialize(std::unique_ptr<SvStream> pStream)
     mbInitialized = true;
 }
 
-tools::SvRef<SotStorageStream> OLEStorageImpl::getStream(const OUString& rPath)
+rtl::Reference<SotStorageStream> OLEStorageImpl::getStream(const OUString& rPath)
 {
     const OUString aPath(lcl_normalizeSubStreamPath(rPath));
     NameMap_t::iterator aIt = maNameMap.find(aPath);
@@ -180,7 +180,7 @@ tools::SvRef<SotStorageStream> OLEStorageImpl::getStream(const OUString& rPath)
     // Later, given how libcdr's zip stream implementation behaves,
     // return the first stream in the storage if there is one.
     if (maNameMap.end() == aIt)
-        return tools::SvRef<SotStorageStream>();
+        return rtl::Reference<SotStorageStream>();
 
     if (!maStreams[aIt->second].stream.is())
         maStreams[aIt->second].stream
@@ -189,7 +189,7 @@ tools::SvRef<SotStorageStream> OLEStorageImpl::getStream(const OUString& rPath)
     return maStreams[aIt->second].stream;
 }
 
-tools::SvRef<SotStorageStream> const& OLEStorageImpl::getStream(const std::size_t nId)
+rtl::Reference<SotStorageStream> const& OLEStorageImpl::getStream(const std::size_t nId)
 {
     if (!maStreams[nId].stream.is())
         maStreams[nId].stream
@@ -198,7 +198,7 @@ tools::SvRef<SotStorageStream> const& OLEStorageImpl::getStream(const std::size_
     return maStreams[nId].stream;
 }
 
-void OLEStorageImpl::traverse(const tools::SvRef<SotStorage>& rStorage, std::u16string_view rPath)
+void OLEStorageImpl::traverse(const rtl::Reference<SotStorage>& rStorage, std::u16string_view rPath)
 {
     SvStorageInfoList infos;
 
@@ -220,7 +220,7 @@ void OLEStorageImpl::traverse(const tools::SvRef<SotStorage>& rStorage, std::u16
         else if (info.IsStorage())
         {
             const OUString aPath = concatPath(rPath, info.GetName());
-            tools::SvRef<SotStorage> aStorage
+            rtl::Reference<SotStorage> aStorage
                 = rStorage->OpenSotStorage(info.GetName(), StreamMode::STD_READ);
             maStorageMap[aPath] = aStorage;
 
@@ -235,7 +235,7 @@ void OLEStorageImpl::traverse(const tools::SvRef<SotStorage>& rStorage, std::u16
     }
 }
 
-tools::SvRef<SotStorageStream> OLEStorageImpl::createStream(const OUString& rPath)
+rtl::Reference<SotStorageStream> OLEStorageImpl::createStream(const OUString& rPath)
 {
     const sal_Int32 nDelim = rPath.lastIndexOf(u'/');
 
@@ -655,7 +655,7 @@ librevenge::RVNGInputStream* WPXSvInputStream::getSubStreamById(const unsigned i
 }
 
 librevenge::RVNGInputStream*
-WPXSvInputStream::createWPXStream(const tools::SvRef<SotStorageStream>& rxStorage)
+WPXSvInputStream::createWPXStream(const rtl::Reference<SotStorageStream>& rxStorage)
 {
     if (rxStorage.is())
     {