[Libreoffice-commits] core.git: Branch 'libreoffice-5-4' - xmloff/source

[Caolán McNamara]

 xmloff/source/text/txtparai.cxx |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

New commits:
commit 6ba5fc85224b8bb0b8e2a5c5013e83644c622e30
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Feb 23 13:08:16 2018 +0000

    forcepoint #5 null deref
    
    Change-Id: I95b67f98b7028d7ca7c4a9d1c15100e42d359816
    Reviewed-on: https://gerrit.libreoffice.org/50243
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>

diff --git a/xmloff/source/text/txtparai.cxx b/xmloff/source/text/txtparai.cxx
index 5708930cf798..d3595aac42cd 100644
--- a/xmloff/source/text/txtparai.cxx
+++ b/xmloff/source/text/txtparai.cxx
@@ -1486,9 +1486,14 @@ XMLImpSpanContext_Impl::XMLImpSpanContext_Impl(
 
 XMLImpSpanContext_Impl::~XMLImpSpanContext_Impl()
 {
-    if( pHint )
-        pHint->SetEnd( GetImport().GetTextImport()
-                            ->GetCursorAsRange()->getStart() );
+    if (!pHint)
+        return;
+
+    Reference<XTextRange> xCrsrRange(GetImport().GetTextImport()->GetCursorAsRange());
+    if (!xCrsrRange.is())
+        return; // Robust (defective file)
+
+    pHint->SetEnd(xCrsrRange->getStart());
 }
 
 SvXMLImportContext *XMLImpSpanContext_Impl::CreateChildContext(
@@ -1884,7 +1889,7 @@ XMLParaContext::~XMLParaContext()
         GetImport().GetTextImport());
     Reference < XTextRange > xCrsrRange( xTxtImport->GetCursorAsRange() );
     if( !xCrsrRange.is() )
-        return; // Robust (defect file)
+        return; // Robust (defective file)
     Reference < XTextRange > xEnd(xCrsrRange->getStart());
 
     // if we have an id set for this paragraph, get a cursor for this
@@ -1910,7 +1915,7 @@ XMLParaContext::~XMLParaContext()
     try {
         xAttrCursor = xTxtImport->GetText()->createTextCursorByRange( xStart );
         if( !xAttrCursor.is() )
-            return; // Robust (defect file)
+            return; // Robust (defective file)
     } catch (const uno::Exception &) {
         // createTextCursorByRange() likes to throw runtime exception, even
         // though it just means 'we were unable to create the cursor'