[Libreoffice-commits] core.git: xmloff/source

[Caolán McNamara]

 xmloff/source/text/txtparai.cxx |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

New commits:
commit c156c9fafff2bf4f60fe300cada4f43b6d8c6fcb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Feb 23 13:08:16 2018 +0000

    forcepoint #5 null deref
    
    Change-Id: I95b67f98b7028d7ca7c4a9d1c15100e42d359816
    Reviewed-on: https://gerrit.libreoffice.org/50241
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/xmloff/source/text/txtparai.cxx b/xmloff/source/text/txtparai.cxx
index 534ec5df005a..e2ee74e1651c 100644
--- a/xmloff/source/text/txtparai.cxx
+++ b/xmloff/source/text/txtparai.cxx
@@ -1484,9 +1484,14 @@ XMLImpSpanContext_Impl::XMLImpSpanContext_Impl(
 
 XMLImpSpanContext_Impl::~XMLImpSpanContext_Impl()
 {
-    if( pHint )
-        pHint->SetEnd( GetImport().GetTextImport()
-                            ->GetCursorAsRange()->getStart() );
+    if (!pHint)
+        return;
+
+    Reference<XTextRange> xCrsrRange(GetImport().GetTextImport()->GetCursorAsRange());
+    if (!xCrsrRange.is())
+        return; // Robust (defective file)
+
+    pHint->SetEnd(xCrsrRange->getStart());
 }
 
 SvXMLImportContextRef XMLImpSpanContext_Impl::CreateChildContext(
@@ -1881,7 +1886,7 @@ void XMLParaContext::EndElement()
         GetImport().GetTextImport());
     Reference < XTextRange > xCrsrRange( xTxtImport->GetCursorAsRange() );
     if( !xCrsrRange.is() )
-        return; // Robust (defect file)
+        return; // Robust (defective file)
     Reference < XTextRange > xEnd(xCrsrRange->getStart());
 
     // if we have an id set for this paragraph, get a cursor for this
@@ -1907,7 +1912,7 @@ void XMLParaContext::EndElement()
     try {
         xAttrCursor = xTxtImport->GetText()->createTextCursorByRange( xStart );
         if( !xAttrCursor.is() )
-            return; // Robust (defect file)
+            return; // Robust (defective file)
     } catch (const uno::Exception &) {
         // createTextCursorByRange() likes to throw runtime exception, even
         // though it just means 'we were unable to create the cursor'