[Libreoffice-commits] core.git: sw/source

[Caolán McNamara (via logerrit)]

 sw/source/core/layout/tabfrm.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 058fdc75afa9e5e69c6e11ab7879ddb9d51ae1c5
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Jun 13 15:55:33 2020 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sat Jun 13 18:13:22 2020 +0200

    crashtesting: null deref in SwCellFrame::GetLayoutRowSpan
    
    seen with swtextframe_connectfootnote_heap_use_after_free.sample
    
    Change-Id: I98da2e67065c5890d74e5f33ffc01329ff75f185
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96257
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 0a3e5f997357..2642c5018f1d 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -5366,7 +5366,8 @@ void SwCellFrame::Modify( const SfxPoolItem* pOld, const SfxPoolItem * pNew )
 
 long SwCellFrame::GetLayoutRowSpan() const
 {
-    long nRet = GetTabBox()->getRowSpan();
+    const SwTableBox *pTabBox = GetTabBox();
+    long nRet = pTabBox ? pTabBox->getRowSpan() : 0;
     if ( nRet < 1 )
     {
         const SwFrame* pRow = GetUpper();