[Libreoffice-commits] core.git: Branch 'distro/collabora/co-2021' - include/oox oox/source sd/qa

[Caolán McNamara (via logerrit)]

 include/oox/ppt/pptshape.hxx              |    2 +
 oox/source/ppt/pptshape.cxx               |   34 ++++++++++++++++++------------
 sd/qa/unit/data/pptx/pass/ofz35597-1.pptx |binary
 3 files changed, 23 insertions(+), 13 deletions(-)

New commits:
commit efdc0f7eebec5effa06475282b98f56d56f97537
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Jun 26 19:26:40 2021 +0100
Commit:     Jan Holesovsky <kendy at collabora.com>
CommitDate: Wed Jun 30 09:53:16 2021 +0200

    ofz#35597 Null-dereference READ
    
    add a check for null getTextBody() return
    
    unfold it a bit while I'm at it
    
    Change-Id: Ib0286048536ad576b520e1adb08fa9b36da9243f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/117938
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 00a658ff104623d4e7fc984b5fc82d1a7e2607f2)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/117871
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice at gmail.com>
    Reviewed-by: Jan Holesovsky <kendy at collabora.com>

diff --git a/include/oox/ppt/pptshape.hxx b/include/oox/ppt/pptshape.hxx
index d27a116e2783..ead382b52685 100644
--- a/include/oox/ppt/pptshape.hxx
+++ b/include/oox/ppt/pptshape.hxx
@@ -54,6 +54,8 @@ class PPTShape final : public oox::drawingml::Shape
     /// Set if spPr tag is non empty for the shape
     bool mbHasNoninheritedShapeProperties;
 
+    bool IsPlaceHolderCandidate(const SlidePersist& rSlidePersist) const;
+
 public:
 
     PPTShape( const oox::ppt::ShapeLocation eShapeLocation,
diff --git a/oox/source/ppt/pptshape.cxx b/oox/source/ppt/pptshape.cxx
index 5f21f7c459c9..7e294f197fe1 100644
--- a/oox/source/ppt/pptshape.cxx
+++ b/oox/source/ppt/pptshape.cxx
@@ -90,7 +90,7 @@ static const char* lclDebugSubType( sal_Int32 nType )
 
 namespace
 {
-bool ShapeHasNoVisualPropertiesOnImport(oox::ppt::PPTShape& rPPTShape)
+bool ShapeHasNoVisualPropertiesOnImport(const oox::ppt::PPTShape& rPPTShape)
 {
     return  !rPPTShape.hasNonInheritedShapeProperties()
             && !rPPTShape.hasShapeStyleRefs()
@@ -126,6 +126,23 @@ oox::drawingml::TextListStylePtr PPTShape::getSubTypeTextListStyle( const SlideP
     return pTextListStyle;
 }
 
+bool PPTShape::IsPlaceHolderCandidate(const SlidePersist& rSlidePersist) const
+{
+    if (meShapeLocation != Slide)
+        return false;
+    if (rSlidePersist.isNotesPage())
+        return false;
+    auto pTextBody = getTextBody();
+    if (!pTextBody)
+        return false;
+    auto rParagraphs = pTextBody->getParagraphs();
+    if (rParagraphs.size() != 1)
+        return false;
+    if (rParagraphs.front()->getRuns().size() != 1)
+        return false;
+    return ShapeHasNoVisualPropertiesOnImport(*this);
+}
+
 void PPTShape::addShape(
         oox::core::XmlFilterBase& rFilterBase,
         const SlidePersist& rSlidePersist,
@@ -193,10 +210,7 @@ void PPTShape::addShape(
                 }
                 break;
                 case XML_dt :
-                    if ( meShapeLocation == Slide && !rSlidePersist.isNotesPage()
-                         && getTextBody()->getParagraphs().size() == 1
-                         && getTextBody()->getParagraphs().front()->getRuns().size() == 1
-                         && ShapeHasNoVisualPropertiesOnImport(*this) )
+                    if (IsPlaceHolderCandidate(rSlidePersist))
                     {
                         TextRunPtr& pTextRun = getTextBody()->getParagraphs().front()->getRuns().front();
                         oox::drawingml::TextField* pTextField = dynamic_cast<oox::drawingml::TextField*>(pTextRun.get());
@@ -232,10 +246,7 @@ void PPTShape::addShape(
                     bClearText = true;
                 break;
                 case XML_ftr :
-                    if ( meShapeLocation == Slide && !rSlidePersist.isNotesPage()
-                         && getTextBody()->getParagraphs().size() == 1
-                         && getTextBody()->getParagraphs().front()->getRuns().size() == 1
-                         && ShapeHasNoVisualPropertiesOnImport(*this) )
+                    if (IsPlaceHolderCandidate(rSlidePersist))
                     {
                         const OUString& rFooterText = getTextBody()->toString();
 
@@ -253,10 +264,7 @@ void PPTShape::addShape(
                     bClearText = true;
                 break;
                 case XML_sldNum :
-                    if (meShapeLocation == Slide && !rSlidePersist.isNotesPage()
-                        && getTextBody()->getParagraphs().size() == 1
-                        && getTextBody()->getParagraphs().front()->getRuns().size() == 1
-                        && ShapeHasNoVisualPropertiesOnImport(*this))
+                    if (IsPlaceHolderCandidate(rSlidePersist))
                     {
                         TextRunPtr& pTextRun
                             = getTextBody()->getParagraphs().front()->getRuns().front();
diff --git a/sd/qa/unit/data/pptx/pass/ofz35597-1.pptx b/sd/qa/unit/data/pptx/pass/ofz35597-1.pptx
new file mode 100644
index 000000000000..e7fcacc25482
Binary files /dev/null and b/sd/qa/unit/data/pptx/pass/ofz35597-1.pptx differ