[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - writerfilter/source

[Caolán McNamara]

 writerfilter/source/rtftok/rtfdispatchsymbol.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 518d3a6173742e0b8b8d30d8ad3584fe5af129c4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 6 20:31:06 2016 +0100

    rtf: throw early on a bad nestrow token
    
    Change-Id: I9de8d09bce18fd1e8a145617794594a99a5f996e
    Reviewed-on: https://gerrit.libreoffice.org/28711
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/writerfilter/source/rtftok/rtfdispatchsymbol.cxx b/writerfilter/source/rtftok/rtfdispatchsymbol.cxx
index 966a0b7..e33d140 100644
--- a/writerfilter/source/rtftok/rtfdispatchsymbol.cxx
+++ b/writerfilter/source/rtftok/rtfdispatchsymbol.cxx
@@ -202,12 +202,12 @@ RTFError RTFDocumentImpl::dispatchSymbol(RTFKeyword nKeyword)
                           pBuffer->pRowProperties,
                           m_nNestedCells, m_nNestedCurrentCellX);
 
-        assert(m_aStates.top().pCurrentBuffer == &m_aTableBufferStack.back());
-        if (m_aTableBufferStack.size() == 1)
+        if (m_aTableBufferStack.size() == 1 || !m_aStates.top().pCurrentBuffer)
         {
             throw io::WrongFormatException(
                 "mismatch between \\itap and number of \\nestrow", nullptr);
         }
+        assert(m_aStates.top().pCurrentBuffer == &m_aTableBufferStack.back());
         // note: there may be several states pointing to table buffer!
         for (std::size_t i = 0; i < m_aStates.size(); ++i)
         {