[Libreoffice-commits] core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/core/layout/frmtool.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit aeeea34074ebaeead66b81d78237361e096852ac
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jun 3 20:01:52 2020 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Fri Jun 5 11:08:30 2020 +0200

    crashtesting: null deref
    
     #0  0x00007f22b35213f0 in SwFrame::getRootFrame() (this=0x0) at sw/source/core/inc/frame.hxx:659
     #1  0x00007f22b3c26a7b in SwPageFrame::RemoveFlyFromPage(SwFlyFrame*) (this=0x0, pToRemove=0x55bbdbfca920) at sw/source/core/layout/flylay.cxx:905
             nOrdNum = 2
     #2  0x00007f22b3c3372e in lcl_RemoveObjsFromPage(SwFrame*) (_pFrame=0x55bbddac3ba0) at sw/source/core/layout/frmtool.cxx:2699
            pFlyFrame = 0x55bbdbfca920
            pCnt = 0x0
            pObj = 0x55bbdbfcaa10
            __for_range = @0x55bbdbd94e60: {maSortedObjLst = std::__debug::vector of length 1, capacity 1 = {0x55bbdbfcaa10}}
            __for_begin = 0x55bbdbfcaa10
            __for_end = 0x55bbdc14da6e
            rObjs = @0x55bbdbd94e60: {maSortedObjLst = std::__debug::vector of length 1, capacity 1 = {0x55bbdbfcaa10}}
    
    commit a96014f1365e411d700a7119dca63cdbb51931dc
    Author: Caolán McNamara <caolanm at redhat.com>
    Date:   Wed Feb 6 12:34:26 2019 +0000
    
        Resolves: tdf#123163 avoid null deref
    
        one RemoveDrawObjFromPage is already null-deref protected,
        do the same for the other
    
    Change-Id: I0e5a58aa35af82bec8a7e3dc1fb361cfa17e3730
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/95452
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/core/layout/frmtool.cxx b/sw/source/core/layout/frmtool.cxx
index 9253d7018d70..ddd7d41e3bc7 100644
--- a/sw/source/core/layout/frmtool.cxx
+++ b/sw/source/core/layout/frmtool.cxx
@@ -2696,7 +2696,8 @@ static void lcl_RemoveObjsFromPage( SwFrame* _pFrame )
             if ( pFlyFrame->IsFlyFreeFrame() )
             {
                 // #i28701# - use new method <GetPageFrame()>
-                pFlyFrame->GetPageFrame()->RemoveFlyFromPage( pFlyFrame );
+                if (SwPageFrame *pPg = pFlyFrame->GetPageFrame())
+                    pPg->RemoveFlyFromPage(pFlyFrame);
             }
         }
         // #115759# - remove also drawing objects from page