[Libreoffice-commits] core.git: 2 commits - sc/source sd/source

[Caolán McNamara (via logerrit)]

 sc/source/ui/view/tabview3.cxx |    2 ++
 sd/source/ui/view/sdview4.cxx  |    7 ++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

New commits:
commit 00ece34fb7916b18053273e54fbe746170570d34
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Jul 18 12:04:21 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Jul 19 09:39:55 2019 +0200

    cid#1448319 Use after free
    
    Change-Id: I45a4ea5c21707606b8853bb775a7d9eec595b88c
    Reviewed-on: https://gerrit.libreoffice.org/75912
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sd/source/ui/view/sdview4.cxx b/sd/source/ui/view/sdview4.cxx
index cb50639b2593..93d88afb7028 100644
--- a/sd/source/ui/view/sdview4.cxx
+++ b/sd/source/ui/view/sdview4.cxx
@@ -270,9 +270,10 @@ SdrGrafObj* View::InsertGraphic( const Graphic& rGraphic, sal_Int8& rAction,
         }
         else
         {
-            InsertObjectAtView(pNewGrafObj, *pPV, nOptions);
-
-            if( pImageMap )
+            bool bSuccess = InsertObjectAtView(pNewGrafObj, *pPV, nOptions);
+            if (!bSuccess)
+                pNewGrafObj = nullptr;
+            else if (pImageMap)
                 pNewGrafObj->AppendUserData(std::unique_ptr<SdrObjUserData>(new SdIMapInfo(*pImageMap)));
         }
     }
commit 7ec75e04da4b7ada7ba120fbc5a30f6d5152cc85
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Jul 18 12:23:51 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Jul 19 09:39:40 2019 +0200

    cid#1448311 Dereference null return value
    
    Change-Id: Ie0ad350d48441dc6012dddc9fa3989acc4d4aab8
    Reviewed-on: https://gerrit.libreoffice.org/75917
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sc/source/ui/view/tabview3.cxx b/sc/source/ui/view/tabview3.cxx
index dd67d915e674..a40eb9374ee9 100644
--- a/sc/source/ui/view/tabview3.cxx
+++ b/sc/source/ui/view/tabview3.cxx
@@ -2557,6 +2557,8 @@ void ScTabView::DoDPFieldPopup(OUString const & rPivotTableName, sal_Int32 nDime
 
     ScDPCollection* pDPCollection = rDocument.GetDPCollection();
     ScDPObject* pDPObject = pDPCollection->GetByName(rPivotTableName);
+    if (!pDPObject)
+        return;
 
     pDPObject->BuildAllDimensionMembers();