[Libreoffice-commits] core.git: editeng/source sc/source

[Caolán McNamara]

 editeng/source/editeng/editeng.cxx |    2 --
 sc/source/filter/rtf/eeimpars.cxx  |   11 ++++++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

New commits:
commit 79742eab111e5f3722075abc3cdb1333faacd076
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Nov 13 15:03:04 2017 +0000

    ofz#4202 Null-dereference READ
    
    Change-Id: Ib9beadaea1bc6521faf7d8080d301e4b5451fb1d
    Reviewed-on: https://gerrit.libreoffice.org/44685
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/editeng/source/editeng/editeng.cxx b/editeng/source/editeng/editeng.cxx
index 3e3b691d207b..bb09af238d99 100644
--- a/editeng/source/editeng/editeng.cxx
+++ b/editeng/source/editeng/editeng.cxx
@@ -1492,8 +1492,6 @@ EditTextObject* EditEngine::CreateTextObject()
 EditTextObject* EditEngine::CreateTextObject( const ESelection& rESelection )
 {
     EditSelection aSel( pImpEditEngine->CreateSel( rESelection ) );
-    if (aSel.IsInvalid())
-        return nullptr;
     return pImpEditEngine->CreateTextObject( aSel );
 }
 
diff --git a/sc/source/filter/rtf/eeimpars.cxx b/sc/source/filter/rtf/eeimpars.cxx
index cac30a4db058..89b8b088be0c 100644
--- a/sc/source/filter/rtf/eeimpars.cxx
+++ b/sc/source/filter/rtf/eeimpars.cxx
@@ -104,6 +104,15 @@ ErrCode ScEEImport::Read( SvStream& rStream, const OUString& rBaseURL )
     return nErr;
 }
 
+namespace
+{
+    bool IsValidSel(const ScTabEditEngine& rEngine, const ESelection& rSel)
+    {
+        const auto nParaCount = rEngine.GetParagraphCount();
+        return rSel.nStartPara < nParaCount && rSel.nEndPara < nParaCount;
+    }
+}
+
 void ScEEImport::WriteToDocument( bool bSizeColsRows, double nOutputFactor, SvNumberFormatter* pFormatter, bool bConvertDate )
 {
     std::unique_ptr<ScProgress> pProgress( new ScProgress( mpDoc->GetDocumentShell(),
@@ -400,7 +409,7 @@ void ScEEImport::WriteToDocument( bool bSizeColsRows, double nOutputFactor, SvNu
                     mpDoc->SetString(nCol, nRow, nTab, aStr, &aParam);
                 }
             }
-            else if (EditTextObject* pTextObject = mpEngine->CreateTextObject(pE->aSel))
+            else if (EditTextObject* pTextObject = IsValidSel(*mpEngine, pE->aSel) ? mpEngine->CreateTextObject(pE->aSel) : nullptr)
             {
                 // The cell will own the text object instance.
                 mpDoc->SetEditText(ScAddress(nCol,nRow,nTab), pTextObject);