tdf#112311 oox: fix UAF of std::shared_ptr

OOXMLFastContextHandlerShape::sendShape() deletes the parent context's
ShapeTypeContext::mrTypeModel.

It looks like the sendShape() can't be delayed because writerfilter
wants to import the v:textbox content into a text frame.

Keep the shape alive until the end of the containing context.

Not sure if it's going to process the v:fill element properly,
but at lest valgrind is happy.

(probably regression from CWS writerfilter32bugfixes01)

Change-Id: Ifeab84751a1b20b2f272c4dd74b7097deb5eece0

2 files changed, 20 insertions, 14 deletions

diff --git a/oox/source/vml/vmlshapecontainer.cxx b/oox/source/vml/vmlshapecontainer.cxx
index d2fea16ea195..366f2fdfbb6a 100644
--- a/oox/source/vml/vmlshapecontainer.cxx
+++ b/oox/source/vml/vmlshapecontainer.cxx
@@ -59,11 +59,11 @@ ShapeContainer::~ShapeContainer()
 {
 }
 
-ShapeType& ShapeContainer::createShapeType()
+std::shared_ptr<ShapeType> ShapeContainer::createShapeType()
 {
     std::shared_ptr< ShapeType > xShape( new ShapeType( mrDrawing ) );
     maTypes.push_back( xShape );
-    return *xShape;
+    return xShape;
 }
 
 void ShapeContainer::finalizeFragmentImport()
diff --git a/oox/source/vml/vmlshapecontext.cxx b/oox/source/vml/vmlshapecontext.cxx
index 84185d40ecfd..dc97726fd0cc 100644
--- a/oox/source/vml/vmlshapecontext.cxx
+++ b/oox/source/vml/vmlshapecontext.cxx
@@ -269,9 +269,12 @@ ContextHandlerRef ShapeContextBase::createShapeContext( ContextHandler2Helper co
     return nullptr;
 }
 
-ShapeTypeContext::ShapeTypeContext( ContextHandler2Helper const & rParent, ShapeType& rShapeType, const AttributeList& rAttribs ) :
-    ShapeContextBase( rParent ),
-    mrTypeModel( rShapeType.getTypeModel() )
+ShapeTypeContext::ShapeTypeContext(ContextHandler2Helper const & rParent,
+        std::shared_ptr<ShapeType> const& pShapeType,
+        const AttributeList& rAttribs)
+    : ShapeContextBase(rParent)
+    , m_pShapeType(pShapeType) // tdf#112311 keep it alive
+    , mrTypeModel( pShapeType->getTypeModel() )
 {
     // shape identifier and shape name
     bool bHasOspid = rAttribs.hasAttribute( O_TOKEN( spid ) );
@@ -444,10 +447,11 @@ void ShapeTypeContext::setStyle( const OUString& rStyle )
     }
 }
 
-ShapeContext::ShapeContext( ContextHandler2Helper const & rParent, ShapeBase& rShape, const AttributeList& rAttribs ) :
-    ShapeTypeContext( rParent, rShape, rAttribs ),
-    mrShape( rShape ),
-    mrShapeModel( rShape.getShapeModel() )
+ShapeContext::ShapeContext(ContextHandler2Helper const & rParent,
+        std::shared_ptr<ShapeBase> pShape, const AttributeList& rAttribs)
+    : ShapeTypeContext( rParent, pShape, rAttribs )
+    , mrShape( *pShape )
+    , mrShapeModel( pShape->getShapeModel() )
 {
     // collect shape specific attributes
     mrShapeModel.maType = rAttribs.getXString( XML_type, OUString() );
@@ -534,9 +538,10 @@ void ShapeContext::setVmlPath( const OUString& rPath )
         mrShapeModel.maVmlPath = rPath;
 }
 
-GroupShapeContext::GroupShapeContext( ContextHandler2Helper const & rParent, GroupShape& rShape, const AttributeList& rAttribs ) :
-    ShapeContext( rParent, rShape, rAttribs ),
-    mrShapes( rShape.getChildren() )
+GroupShapeContext::GroupShapeContext(ContextHandler2Helper const & rParent,
+        std::shared_ptr<GroupShape> pShape, const AttributeList& rAttribs)
+    : ShapeContext( rParent, pShape, rAttribs )
+    , mrShapes( pShape->getChildren() )
 {
 }
 
@@ -548,8 +553,9 @@ ContextHandlerRef GroupShapeContext::onCreateContext( sal_Int32 nElement, const
     return xContext.get() ? xContext : ShapeContext::onCreateContext( nElement, rAttribs );
 }
 
-RectangleShapeContext::RectangleShapeContext( ContextHandler2Helper const & rParent, const AttributeList& rAttribs, RectangleShape& rShape ) :
-    ShapeContext( rParent, rShape, rAttribs )
+RectangleShapeContext::RectangleShapeContext(ContextHandler2Helper const & rParent,
+        const AttributeList& rAttribs, std::shared_ptr<RectangleShape> pShape)
+    : ShapeContext( rParent, pShape, rAttribs )
 {
 }