From 454d20cad04692c443e7a66dd53f0918b22a5638 Mon Sep 17 00:00:00 2001 From: Eitan Isaacson Date: Tue, 08 Jun 2021 22:21:05 +0000 (2021-06-09) Subject: [PATCH] CVE-2021-29970 --- accessible/base/SelectionManager.cpp | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/accessible/base/SelectionManager.cpp b/accessible/base/SelectionManager.cpp index 5b37cf1528..c86841d20c 100644 --- a/accessible/base/SelectionManager.cpp +++ b/accessible/base/SelectionManager.cpp @@ -101,6 +101,24 @@ void SelectionManager::RemoveDocSelectionListener(PresShell* aPresShell) { // selection. Selection* spellSel = frameSel->GetSelection(SelectionType::eSpellCheck); spellSel->RemoveSelectionListener(this); + + if (mCurrCtrlNormalSel) { + if (mCurrCtrlNormalSel->GetPresShell() == aPresShell) { + // Remove 'this' registered as selection listener for the normal selection + // if we are removing listeners for its PresShell. + mCurrCtrlNormalSel->RemoveSelectionListener(this); + mCurrCtrlNormalSel = nullptr; + } + } + + if (mCurrCtrlSpellSel) { + if (mCurrCtrlSpellSel->GetPresShell() == aPresShell) { + // Remove 'this' registered as selection listener for the spellcheck + // selection if we are removing listeners for its PresShell. + mCurrCtrlSpellSel->RemoveSelectionListener(this); + mCurrCtrlSpellSel = nullptr; + } + } } void SelectionManager::ProcessTextSelChangeEvent(AccEvent* aEvent) { -- 2.27.0