New Defects reported by Coverity Scan for LibreOffice
scan-admin at coverity.com
scan-admin at coverity.com
Sat Jun 9 16:33:03 UTC 2018
Hi,
Please find the latest report on new defect(s) introduced to LibreOffice found with Coverity Scan.
7 new defect(s) introduced to LibreOffice found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 7 of 7 defect(s)
** CID 1436018: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1436018: Null pointer dereferences (FORWARD_NULL)
/sw/source/core/text/txtfrm.cxx: 1991 in SwTextFrame::SwClientNotify(const SwModify &, const SfxHint &)()
1985 }
1986
1987 if (nClear || (m_pMergedPara &&
1988 (m_pMergedPara->pParaPropsNode != &rModify ||
1989 m_pMergedPara->pFirstNode != &rModify)))
1990 {
>>> CID 1436018: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "pOld" to "SwAttrSetChg", which dereferences it.
1991 SwAttrSetChg aOldSet( *static_cast<const SwAttrSetChg*>(pOld) );
1992 SwAttrSetChg aNewSet( *static_cast<const SwAttrSetChg*>(pNew) );
1993
1994 if (m_pMergedPara && m_pMergedPara->pParaPropsNode != &rModify)
1995 {
1996 for (sal_uInt16 i = RES_PARATR_BEGIN; i != RES_FRMATR_END; ++i)
** CID 1436017: Control flow issues (DEADCODE)
/sw/source/core/text/txtfrm.cxx: 1634 in SwTextFrame::SwClientNotify(const SwModify &, const SfxHint &)()
________________________________________________________________________________________________________
*** CID 1436017: Control flow issues (DEADCODE)
/sw/source/core/text/txtfrm.cxx: 1634 in SwTextFrame::SwClientNotify(const SwModify &, const SfxHint &)()
1628 // update merged before doing anything else
1629 nLen = UpdateMergedParaForDelete(*m_pMergedPara, false, rNode, nNPos, nNLen);
1630 const sal_Int32 m = -nNLen;
1631 if (nLen && IsIdxInside(nPos, nLen))
1632 {
1633 if (!nLen)
>>> CID 1436017: Control flow issues (DEADCODE)
>>> Execution cannot reach this statement: "this->InvalidateSize();".
1634 InvalidateSize();
1635 else
1636 InvalidateRange( SwCharRange(nPos, TextFrameIndex(1)), m );
1637 }
1638 lcl_SetWrong( *this, rNode, nNPos, m, true );
1639 if (nLen)
** CID 1436016: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1436016: Null pointer dereferences (FORWARD_NULL)
/sw/source/core/crsr/crsrsh.cxx: 967 in SwCursorShell::TestCurrPam(const Point &, bool)()
961 do {
962 if( pCmp && pCmp->HasMark() &&
963 *pCmp->Start() <= aPtPos && *pCmp->End() > aPtPos )
964 {
965 return true; // return without update
966 }
>>> CID 1436016: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "pCmp" to "GetNext", which dereferences it.
967 } while( m_pCurrentCursor != ( pCmp = pCmp->GetNext() ) );
968 return false;
969 }
970
971 void SwCursorShell::KillPams()
972 {
** CID 1436015: Code maintainability issues (UNUSED_VALUE)
/oox/source/drawingml/diagram/diagramlayoutatoms.cxx: 373 in oox::drawingml::AlgAtom::layoutShape(const std::shared_ptr<oox::drawingml::Shape> &, const std::vector<oox::drawingml::Constraint, std::allocator<oox::drawingml::Constraint>> &) const()
________________________________________________________________________________________________________
*** CID 1436015: Code maintainability issues (UNUSED_VALUE)
/oox/source/drawingml/diagram/diagramlayoutatoms.cxx: 373 in oox::drawingml::AlgAtom::layoutShape(const std::shared_ptr<oox::drawingml::Shape> &, const std::vector<oox::drawingml::Constraint, std::allocator<oox::drawingml::Constraint>> &) const()
367 aChildSize.Height /= (nCount+1);
368
369 awt::Point aCurrPos(0, 0);
370 if (nIncX == -1)
371 aCurrPos.X = rShape->getSize().Width - aChildSize.Width;
372 if (nIncY == -1)
>>> CID 1436015: Code maintainability issues (UNUSED_VALUE)
>>> Assigning value from "rShape->getSize().Height - aChildSize.Height" to "aCurrPos.Y" here, but that stored value is overwritten before it can be used.
373 aCurrPos.Y = rShape->getSize().Height - aChildSize.Height;
374
375 if(nCount <= 2 && nIncY == -1)
376 aCurrPos.Y = rShape->getSize().Height - aChildSize.Height*2;
377 else
378 aCurrPos.Y = rShape->getSize().Height - aChildSize.Height*(nCount+1);
** CID 1436014: Null pointer dereferences (NULL_RETURNS)
________________________________________________________________________________________________________
*** CID 1436014: Null pointer dereferences (NULL_RETURNS)
/sw/source/core/undo/rolbck.cxx: 493 in SwHistorySetFootnote::SetInDoc(SwDoc *, bool)()
487 }
488 else
489 {
490 SwTextFootnote * const pFootnote =
491 static_cast<SwTextFootnote*>(
492 pTextNd->GetTextAttrForCharAt( m_nStart ));
>>> CID 1436014: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing a pointer that might be null "pFootnote" when calling "GetFootnote".
493 SwFormatFootnote &rFootnote = const_cast<SwFormatFootnote&>(pFootnote->GetFootnote());
494 rFootnote.SetNumStr( m_FootnoteNumber );
495 if ( rFootnote.IsEndNote() != m_bEndNote )
496 {
497 rFootnote.SetEndNote( m_bEndNote );
498 pFootnote->CheckCondColl();
** CID 1436013: Integer handling issues (SIGN_EXTENSION)
/sw/source/core/text/guess.cxx: 152 in SwTextGuess::Guess(const SwTextPortion &, SwTextFormatInfo &, unsigned short)()
________________________________________________________________________________________________________
*** CID 1436013: Integer handling issues (SIGN_EXTENSION)
/sw/source/core/text/guess.cxx: 152 in SwTextGuess::Guess(const SwTextPortion &, SwTextFormatInfo &, unsigned short)()
146 nLineWidth -= nLeftRightBorderSpace;
147
148 const bool bUnbreakableNumberings = rInf.GetTextFrame()->GetDoc()
149 .getIDocumentSettingAccess().get(DocumentSettingId::UNBREAKABLE_NUMBERINGS);
150
151 // first check if everything fits to line
>>> CID 1436013: Integer handling issues (SIGN_EXTENSION)
>>> Suspicious implicit sign extension: "nPorHeight" with type "sal_uInt16 const" (16 bits, unsigned) is promoted in "(sal_Int32)nMaxLen * nPorHeight" to type "int" (32 bits, signed), then sign-extended to type "long" (64 bits, signed). If "(sal_Int32)nMaxLen * nPorHeight" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
152 if ( ( long ( nLineWidth ) * 2 > sal_Int32(nMaxLen) * nPorHeight ) ||
153 ( bUnbreakableNumberings && rPor.IsNumberPortion() ) )
154 {
155 // call GetTextSize with maximum compression (for kanas)
156 rInf.GetTextSize( &rSI, rInf.GetIdx(), nMaxLen,
157 nMaxComp, nBreakWidth, nMaxSizeDiff );
** CID 735800: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 735800: Null pointer dereferences (FORWARD_NULL)
/sc/source/filter/xml/xmlimprt.cxx: 1811 in ScXMLImport::endDocument()()
1805 }
1806 }
1807
1808 // There are rows with optimal height which need to be updated
1809 if (!maRecalcRowRanges.empty())
1810 {
>>> CID 735800: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "this->pDoc" to "IsAdjustHeightLocked", which dereferences it.
1811 bool bLockHeight = pDoc->IsAdjustHeightLocked();
1812 if (bLockHeight)
1813 {
1814 pDoc->UnlockAdjustHeight();
1815 }
1816
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRZBnDJeNb0HijxaS4JNJPxk3kpyAm2AYqo71yXmnOxB72ibeUH-2F-2F1Lhi9AZq3dRu-2F4-3D_g-2BrHdvqzaBa155F-2F8AmPhpJzY63UzWDisJV95WUBpGhqFw1ICExHG8aMaV2EoFpy0pLR39QW3eiDoX6XEK31pX-2Bq3xk-2BJ0lUDhEhqq7BjRXyzZTxXMUwqZ-2B4Fe1xTR89sQbuOFBj-2Fr02RsFs9yK4IexpmVUWOt9fTjzuijmDk6j0hhYbVBoFkAtTuRj3HN-2F1Uo2NJbTaMYlbvD3PFJYRLSWRNdoyHII6-2FBZyOgwXDv4-3D
More information about the LibreOffice
mailing list