From 65d69bb68de80c3e203f6f613abed1bd9ce43cfd Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 10 Sep 2021 16:12:02 +0100
Subject: crashtesting: threaded scaling crash on re-export of ooo24840-1.sxw
 to odt

 #13 0x00007f1cb843752a in o3tl::cow_wrapper<ImplBitmapPalette, o3tl::UnsafeRefCountingPolicy>::operator->() (this=0x5596086d5968) at include/o3tl/cow_wrapper.hxx:329
         __PRETTY_FUNCTION__ = "BitmapColor& BitmapPalette::operator[](sal_uInt16)"
 #14 0x00007f1cb843752a in BitmapPalette::operator[](unsigned short) (this=0x5596086d5968, nIndex=nIndex@entry=0) at vcl/source/bitmap/bitmappalette.cxx:139
         __PRETTY_FUNCTION__ = "BitmapColor& BitmapPalette::operator[](sal_uInt16)"
 #15 0x00007f1cb849f5f5 in BitmapInfoAccess::GetPaletteColor(unsigned short) const (nColor=0, this=0x5596085989f0) at include/vcl/BitmapInfoAccess.hxx:114
         __PRETTY_FUNCTION__ = "const BitmapColor& BitmapInfoAccess::GetPaletteColor(sal_uInt16) const"

the mpBuffer member of BitmapInfoAccess is

BitmapBuffer* mpBuffer;

not

const BitmapBuffer* mpBuffer;

so mpBuffer->maPalette.foo() calls non-const variants of foo(),
(BitmapPalette::operator[](unsigned short) in this case), which
is presumably non the expected outcome, as the copy-on-write mpImpl of
BitmapPalette unsafely creates a new copy its internals on the first
dereference of mpImpl in a non-const method.

Change-Id: I1ebb3c67386a9028e5b8bab4b2d1cc5862700aa1
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/121888
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
---
 include/vcl/BitmapInfoAccess.hxx       | 29 +++++++++++++++++++----------
 include/vcl/BitmapReadAccess.hxx       |  5 ++++-
 vcl/source/bitmap/BitmapInfoAccess.cxx |  4 +++-
 3 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/include/vcl/BitmapInfoAccess.hxx b/include/vcl/BitmapInfoAccess.hxx
index 86c4ada2ae16..a6bca5627aa2 100644
--- a/include/vcl/BitmapInfoAccess.hxx
+++ b/include/vcl/BitmapInfoAccess.hxx
@@ -87,40 +87,49 @@ public:
 
     bool HasPalette() const
     {
-        assert(mpBuffer && "Access is not valid!");
+        const BitmapBuffer* pBuffer = mpBuffer;
+
+        assert(pBuffer && "Access is not valid!");
 
-        return mpBuffer && !!mpBuffer->maPalette;
+        return pBuffer && !!pBuffer->maPalette;
     }
 
     const BitmapPalette& GetPalette() const
     {
-        assert(mpBuffer && "Access is not valid!");
+        const BitmapBuffer* pBuffer = mpBuffer;
+
+        assert(pBuffer && "Access is not valid!");
 
-        return mpBuffer->maPalette;
+        return pBuffer->maPalette;
     }
 
     sal_uInt16 GetPaletteEntryCount() const
     {
+        const BitmapBuffer* pBuffer = mpBuffer;
+
         assert(HasPalette() && "Bitmap has no palette!");
 
-        return HasPalette() ? mpBuffer->maPalette.GetEntryCount() : 0;
+        return HasPalette() ? pBuffer->maPalette.GetEntryCount() : 0;
     }
 
     const BitmapColor& GetPaletteColor(sal_uInt16 nColor) const
     {
-        assert(mpBuffer && "Access is not valid!");
+        const BitmapBuffer* pBuffer = mpBuffer;
+        assert(pBuffer && "Access is not valid!");
         assert(HasPalette() && "Bitmap has no palette!");
 
-        return mpBuffer->maPalette[nColor];
+        return pBuffer->maPalette[nColor];
     }
 
     sal_uInt16 GetBestPaletteIndex(const BitmapColor& rBitmapColor) const;
 
-    ColorMask& GetColorMask() const
+    const ColorMask& GetColorMask() const
     {
-        assert(mpBuffer && "Access is not valid!");
+        const BitmapBuffer* pBuffer = mpBuffer;
+
+        assert(pBuffer && "Access is not valid!");
 
-        return mpBuffer->maColorMask;
+        return pBuffer->maColorMask;
     }
 
 private:
diff --git a/include/vcl/BitmapReadAccess.hxx b/include/vcl/BitmapReadAccess.hxx
index 2659a9960a51..159ff38b157e 100644
--- a/include/vcl/BitmapReadAccess.hxx
+++ b/include/vcl/BitmapReadAccess.hxx
@@ -88,7 +88,10 @@ public:
     BitmapColor GetColor(tools::Long nY, tools::Long nX) const
     {
         if (HasPalette())
-            return mpBuffer->maPalette[GetPixelIndex(nY, nX)];
+        {
+            const BitmapBuffer* pBuffer = mpBuffer;
+            return pBuffer->maPalette[GetPixelIndex(nY, nX)];
+        }
         else
             return GetPixel(nY, nX);
     }
diff --git a/vcl/source/bitmap/BitmapInfoAccess.cxx b/vcl/source/bitmap/BitmapInfoAccess.cxx
index 595d5cbbbcc5..50607e94dde3 100644
--- a/vcl/source/bitmap/BitmapInfoAccess.cxx
+++ b/vcl/source/bitmap/BitmapInfoAccess.cxx
@@ -72,7 +72,9 @@ BitmapInfoAccess::~BitmapInfoAccess()
 
 sal_uInt16 BitmapInfoAccess::GetBestPaletteIndex(const BitmapColor& rBitmapColor) const
 {
-    return (HasPalette() ? mpBuffer->maPalette.GetBestIndex(rBitmapColor) : 0);
+    const BitmapBuffer* pBuffer = mpBuffer;
+
+    return (HasPalette() ? pBuffer->maPalette.GetBestIndex(rBitmapColor) : 0);
 }
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
-- 
cgit