<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
Hi!<br><a href="https://bugs.freedesktop.org/show_bug.cgi?id=47436"><br>https://bugs.freedesktop.org/show_bug.cgi?id=47436</a><br><br><pre class="bz_comment_text" id="comment_text_6">Hi!
editeng/source/items/frmitems.cxx:1954
1951: for (int n(0); n != SAL_N_ELEMENTS(aBorders); ++n)
1952: {
1953: editeng::SvxBorderLine* pLine = const_cast< editeng::SvxBorderLine*
<span class="quote">>( GetLine( aBorders[n] ) );</span>
1954: pLine->SetStyle( eBorderStyle );
1956: }
Here pLine is a NULL pointer, so calling its member function (SetStyle) causes
SIGSEGV.
<br>aBorders is just an array with 4 elements: { BOX_LINE_LEFT, BOX_LINE_RIGHT, BOX_LINE_BOTTOM, BOX_LINE_TOP }<br>GetLine returns pLeft, pTop, pRight, pBottom. All of these are NULL pointers in this case.<br>These get their values in sw/source/core/unocore/unoframe.cxx (from line 370)<br><br>370: const ::uno::Any* pLeft = 0;<br>371: GetProperty(RES_BOX, LEFT_BORDER |CONVERT_TWIPS, pLeft );<br><br>pLeft remains NULL after this (and pTop, pRight, pBottom too)<br><br>so these:<br>396: SvxBoxItem aBox ( static_cast < const :: SvxBoxItem & > ( rFromSet.Get ( RES_BOX ) ) );<br>397: if( pLeft )<br>398: bRet &= ((SfxPoolItem&)aBox).PutValue(*pLeft, CONVERT_TWIPS|LEFT_BORDER );<br>are not executed, and aBox's pLeft (etc) members remain NULLs.<br>but this:<br>415: if( pLineStyle )<br>416: bRet &= ((SfxPoolItem&)aBox).PutValue(*pLineStyle, LINE_STYLE);<br>gets executed, and this has a call to pLine->SetStyle (line 1954 mentioned earlier)<br>
Putting 'if( pLine )' before line 1954 causes LO to load the document.<br><br>PS.: Like on bug's page. It isn't sure that the odt is valid, but it shouldn't crash anyway.<br><br>Szabolcs<br></pre> </div></body>
</html>