[Libreoffice-commits] core.git: editeng/source sc/source

[Caolán McNamara]

 editeng/source/editeng/editeng.cxx |    2 ++
 sc/source/filter/rtf/eeimpars.cxx  |    4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

New commits:
commit d64f6caf22715fb421f4b89820c0842b7cae6905
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Nov 10 09:58:31 2017 +0000

    ofz#4163 Null-dereference READ
    
    Change-Id: I3d1ae5f55343b1b8ec3b0d79a56c9368385a0af8
    Reviewed-on: https://gerrit.libreoffice.org/44581
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/editeng/source/editeng/editeng.cxx b/editeng/source/editeng/editeng.cxx
index bb09af238d99..3e3b691d207b 100644
--- a/editeng/source/editeng/editeng.cxx
+++ b/editeng/source/editeng/editeng.cxx
@@ -1492,6 +1492,8 @@ EditTextObject* EditEngine::CreateTextObject()
 EditTextObject* EditEngine::CreateTextObject( const ESelection& rESelection )
 {
     EditSelection aSel( pImpEditEngine->CreateSel( rESelection ) );
+    if (aSel.IsInvalid())
+        return nullptr;
     return pImpEditEngine->CreateTextObject( aSel );
 }
 
diff --git a/sc/source/filter/rtf/eeimpars.cxx b/sc/source/filter/rtf/eeimpars.cxx
index f84cc987ef8d..cac30a4db058 100644
--- a/sc/source/filter/rtf/eeimpars.cxx
+++ b/sc/source/filter/rtf/eeimpars.cxx
@@ -400,10 +400,10 @@ void ScEEImport::WriteToDocument( bool bSizeColsRows, double nOutputFactor, SvNu
                     mpDoc->SetString(nCol, nRow, nTab, aStr, &aParam);
                 }
             }
-            else
+            else if (EditTextObject* pTextObject = mpEngine->CreateTextObject(pE->aSel))
             {
                 // The cell will own the text object instance.
-                mpDoc->SetEditText(ScAddress(nCol,nRow,nTab), mpEngine->CreateTextObject(pE->aSel));
+                mpDoc->SetEditText(ScAddress(nCol,nRow,nTab), pTextObject);
             }
             if ( !pE->maImageList.empty() )
                 bHasGraphics |= GraphicSize( nCol, nRow, pE );