New Defects reported by Coverity Scan for LibreOffice
scan-admin at coverity.com
scan-admin at coverity.com
Wed Jul 17 16:53:04 UTC 2019
Hi,
Please find the latest report on new defect(s) introduced to LibreOffice found with Coverity Scan.
20 new defect(s) introduced to LibreOffice found with Coverity Scan.
81 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 20 of 20 defect(s)
** CID 1451643: Uninitialized members (UNINIT_CTOR)
/cui/source/dialogs/SpellDialog.cxx: 1117 in svx::SentenceEditWindow_Impl::SentenceEditWindow_Impl()()
________________________________________________________________________________________________________
*** CID 1451643: Uninitialized members (UNINIT_CTOR)
/cui/source/dialogs/SpellDialog.cxx: 1117 in svx::SentenceEditWindow_Impl::SentenceEditWindow_Impl()()
1111
1112 SentenceEditWindow_Impl::SentenceEditWindow_Impl()
1113 : m_nErrorStart(0)
1114 , m_nErrorEnd(0)
1115 , m_bIsUndoEditMode(false)
1116 {
>>> CID 1451643: Uninitialized members (UNINIT_CTOR)
>>> Non-static class member "m_pToolbar" is not initialized in this constructor nor in any functions that it calls.
1117 }
1118
1119 void SentenceEditWindow_Impl::SetDrawingArea(weld::DrawingArea* pDrawingArea)
1120 {
1121 Size aSize(pDrawingArea->get_approximate_digit_width() * 60,
1122 pDrawingArea->get_text_height() * 6);
** CID 1451642: Integer handling issues (DIVIDE_BY_ZERO)
________________________________________________________________________________________________________
*** CID 1451642: Integer handling issues (DIVIDE_BY_ZERO)
/sd/source/ui/unoidl/UnoDocumentSettings.cxx: 706 in sd::DocumentSettings::_setPropertyValues(const comphelper::PropertyMapEntry **, const com::sun::star::uno::Any *)()
700 case HANDLE_SCALE_DOM:
701 {
702 sal_Int32 nValue = 0;
703 if( *pValues >>= nValue )
704 {
705 Fraction aFract( pDoc->GetUIScale().GetNumerator(), nValue );
>>> CID 1451642: Integer handling issues (DIVIDE_BY_ZERO)
>>> In function call "SetUIScale", modulo by expression "aFract.mnNumerator" which may be zero has undefined behavior.
706 pDoc->SetUIScale( aFract );
707 bOk = true;
708 bChanged = true;
709 }
710 }
711 break;
** CID 1451641: Error handling issues (CHECKED_RETURN)
/vcl/source/gdi/virdev.cxx: 482 in VirtualDevice::ImplSetReferenceDevice(VirtualDevice::RefDevMode, int, int)()
________________________________________________________________________________________________________
*** CID 1451641: Error handling issues (CHECKED_RETURN)
/vcl/source/gdi/virdev.cxx: 482 in VirtualDevice::ImplSetReferenceDevice(VirtualDevice::RefDevMode, int, int)()
476 // preserve global font lists
477 ImplSVData* pSVData = ImplGetSVData();
478 mxFontCollection.reset();
479 mxFontCache.reset();
480
481 // get font list with scalable fonts only
>>> CID 1451641: Error handling issues (CHECKED_RETURN)
>>> Calling "AcquireGraphics" without checking return value (as is done elsewhere 4 out of 5 times).
482 AcquireGraphics();
483 mxFontCollection = pSVData->maGDIData.mxScreenFontList->Clone();
484
485 // prepare to use new font lists
486 mxFontCache.reset(new ImplFontCache);
487 }
** CID 1451640: (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 91 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 80 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 55 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 66 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 117 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 109 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
________________________________________________________________________________________________________
*** CID 1451640: (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 91 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
85
86 aRelativeSize.Primary =
87 static_cast< double >( aObjectRect.getWidth()) /
88 static_cast< double >( aPageRect.getWidth() );
89 if (aRelativeSize.Primary > 1.0)
90 aRelativeSize.Primary = 1.0;
>>> CID 1451640: (DIVIDE_BY_ZERO)
>>> In expression "static_cast<double>(aObjectRect.getHeight()) / static_cast<double>(aPageRect.getHeight())", division by expression "aPageRect.getHeight()" which may be zero has undefined behavior.
91 aRelativeSize.Secondary =
92 static_cast< double >( aObjectRect.getHeight()) /
93 static_cast< double >( aPageRect.getHeight());
94 if (aRelativeSize.Secondary > 1.0)
95 aRelativeSize.Secondary = 1.0;
96
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 80 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
74 chart2::RelativeSize aRelativeSize;
75 Point aAnchor = aObjectRect.TopLeft();
76
77 aRelativePosition.Primary =
78 static_cast< double >( aAnchor.X()) /
79 static_cast< double >( aPageRect.getWidth() );
>>> CID 1451640: (DIVIDE_BY_ZERO)
>>> In expression "static_cast<double>(aAnchor.Y()) / static_cast<double>(aPageRect.getHeight())", division by expression "aPageRect.getHeight()" which may be zero has undefined behavior.
80 aRelativePosition.Secondary =
81 static_cast< double >( aAnchor.Y()) /
82 static_cast< double >( aPageRect.getHeight());
83
84 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
85
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 55 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
49 //@todo decide whether x is primary or secondary
50 chart2::RelativePosition aRelativePosition;
51 aRelativePosition.Anchor = drawing::Alignment_CENTER;
52 //the anchor point at the title object is top/middle
53 Point aPos = aObjectRect.TopLeft();
54 aRelativePosition.Primary = (double(aPos.X())+double(aObjectRect.getWidth())/2.0)/double(aPageRect.getWidth());
>>> CID 1451640: (DIVIDE_BY_ZERO)
>>> In expression "((double)aPos.Y() + (double)aObjectRect.getHeight() / 2.) / (double)aPageRect.getHeight()", division by expression "aPageRect.getHeight()" which may be zero has undefined behavior.
55 aRelativePosition.Secondary = (double(aPos.Y())+double(aObjectRect.getHeight())/2.0)/double(aPageRect.getHeight());
56 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
57 }
58 else if( eObjectType==OBJECTTYPE_DATA_CURVE_EQUATION )
59 {
60 //@todo decide whether x is primary or secondary
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 66 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
60 //@todo decide whether x is primary or secondary
61 chart2::RelativePosition aRelativePosition;
62 aRelativePosition.Anchor = drawing::Alignment_TOP_LEFT;
63 //the anchor point at the title object is top/middle
64 Point aPos = aObjectRect.TopLeft();
65 aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
>>> CID 1451640: (DIVIDE_BY_ZERO)
>>> In expression "(double)aPos.Y() / (double)aPageRect.getHeight()", division by expression "aPageRect.getHeight()" which may be zero has undefined behavior.
66 aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
67 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
68 }
69 else if(eObjectType==OBJECTTYPE_LEGEND)
70 {
71 xObjectProp->setPropertyValue( "AnchorPosition", uno::Any(LegendPosition_CUSTOM));
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 117 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
111
112 //set size:
113 RelativeSize aRelativeSize;
114 //the anchor points for the diagram are in the middle of the diagram
115 //and in the middle of the page
116 aRelativeSize.Primary = double(aObjectRect.getWidth())/double(aPageRect.getWidth());
>>> CID 1451640: (DIVIDE_BY_ZERO)
>>> In expression "(double)aObjectRect.getHeight() / (double)aPageRect.getHeight()", division by expression "aPageRect.getHeight()" which may be zero has undefined behavior.
117 aRelativeSize.Secondary = double(aObjectRect.getHeight())/double(aPageRect.getHeight());
118 xObjectProp->setPropertyValue( "RelativeSize", uno::Any(aRelativeSize) );
119 }
120 else
121 return false;
122 return true;
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 109 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
103 //set position:
104 chart2::RelativePosition aRelativePosition;
105 aRelativePosition.Anchor = drawing::Alignment_CENTER;
106
107 Point aPos = aObjectRect.Center();
108 aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
>>> CID 1451640: (DIVIDE_BY_ZERO)
>>> In expression "(double)aPos.Y() / (double)aPageRect.getHeight()", division by expression "aPageRect.getHeight()" which may be zero has undefined behavior.
109 aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
110 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
111
112 //set size:
113 RelativeSize aRelativeSize;
114 //the anchor points for the diagram are in the middle of the diagram
** CID 1451639: Memory - illegal accesses (USE_AFTER_FREE)
________________________________________________________________________________________________________
*** CID 1451639: Memory - illegal accesses (USE_AFTER_FREE)
/sw/source/core/layout/paintfrm.cxx: 4163 in SwTabFrame::PaintSwFrame(OutputDevice &, const SwRect &, const SwPrintData *) const()
4157 SwRect aTabRect( getFramePrintArea() );
4158 aTabRect.Pos() += getFrameArea().Pos();
4159 SwRect aTabOutRect( rRect );
4160 aTabOutRect.Intersection( aTabRect );
4161 SwViewOption::DrawRect( &rRenderContext, aTabOutRect, COL_LIGHTGRAY );
4162 }
>>> CID 1451639: Memory - illegal accesses (USE_AFTER_FREE)
>>> Calling "ResetComplete" dereferences freed pointer "const_cast<SwTabFrame *>(this)".
4163 const_cast<SwTabFrame*>(this)->ResetComplete();
4164 }
4165
4166 /**
4167 * Paint border shadow
4168 *
** CID 1451638: Null pointer dereferences (FORWARD_NULL)
/sw/source/core/doc/docbm.cxx: 1350 in sw::mark::MarkManager::NotifyCursorUpdate(const SwCursorShell &)()
________________________________________________________________________________________________________
*** CID 1451638: Null pointer dereferences (FORWARD_NULL)
/sw/source/core/doc/docbm.cxx: 1350 in sw::mark::MarkManager::NotifyCursorUpdate(const SwCursorShell &)()
1344 if ( pFieldBM && (pFieldBM->GetFieldname() == ODF_FORMDROPDOWN ||
1345 pFieldBM->GetFieldname() == ODF_FORMDATE))
1346 {
1347 if (m_pLastActiveFieldmark != pFieldBM)
1348 {
1349 auto pFormField = dynamic_cast<FieldmarkWithDropDownButton*>(pFieldBM);
>>> CID 1451638: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "pFormField" to "ShowButton", which dereferences it. (The dereference happens because this is a virtual function call.)
1350 pFormField->ShowButton(&rEditWin);
1351 pNewActiveFieldmark = pFormField;
1352 }
1353 else
1354 {
1355 pNewActiveFieldmark = m_pLastActiveFieldmark;
** CID 1451637: (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1451637: (FORWARD_NULL)
/editeng/source/editeng/impedit3.cxx: 1320 in ImpEditEngine::CreateLines(int, unsigned int)()
1314 }
1315 }
1316 else
1317 {
1318 bEOL = true;
1319 bEOC = true;
>>> CID 1451637: (FORWARD_NULL)
>>> Passing null pointer "pLine" to "SetEnd", which dereferences it.
1320 pLine->SetEnd( nPortionEnd );
1321 DBG_ASSERT( pParaPortion->GetTextPortions().Count(), "No TextPortions?" );
1322 pLine->SetEndPortion( pParaPortion->GetTextPortions().Count() - 1 );
1323 }
1324
1325 if ( aStatus.OneCharPerLine() )
/editeng/source/editeng/impedit3.cxx: 1327 in ImpEditEngine::CreateLines(int, unsigned int)()
1321 DBG_ASSERT( pParaPortion->GetTextPortions().Count(), "No TextPortions?" );
1322 pLine->SetEndPortion( pParaPortion->GetTextPortions().Count() - 1 );
1323 }
1324
1325 if ( aStatus.OneCharPerLine() )
1326 {
>>> CID 1451637: (FORWARD_NULL)
>>> Passing null pointer "pLine" to "SetEnd", which dereferences it.
1327 pLine->SetEnd( nPortionEnd );
1328 pLine->SetEndPortion( nTmpPortion-1 );
1329 }
1330 else if ( bFixedEnd )
1331 {
1332 pLine->SetEnd( nPortionStart );
** CID 1451636: (DIVIDE_BY_ZERO)
________________________________________________________________________________________________________
*** CID 1451636: (DIVIDE_BY_ZERO)
/sc/source/ui/unoobj/docuno.cxx: 2068 in ScModelObj::render(int, const com::sun::star::uno::Any &, const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2062 // to get the target rectangle in pixels.
2063
2064 Fraction aScaleX( aLocationPixel.GetWidth(), aLocationMM.GetWidth() );
2065 Fraction aScaleY( aLocationPixel.GetHeight(), aLocationMM.GetHeight() );
2066
2067 long nX1 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
>>> CID 1451636: (DIVIDE_BY_ZERO)
>>> In function call "operator *", modulo by expression "aScaleX.mnNumerator" which may be zero has undefined behavior.
2068 long nX2 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
2069 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
2070 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071
2072 if ( nX1 > aLocationPixel.Right() ) nX1 = aLocationPixel.Right();
2073 if ( nX2 > aLocationPixel.Right() ) nX2 = aLocationPixel.Right();
/sc/source/ui/unoobj/docuno.cxx: 2067 in ScModelObj::render(int, const com::sun::star::uno::Any &, const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2061 // Scale and move the target rectangle from aLocationMM to aLocationPixel,
2062 // to get the target rectangle in pixels.
2063
2064 Fraction aScaleX( aLocationPixel.GetWidth(), aLocationMM.GetWidth() );
2065 Fraction aScaleY( aLocationPixel.GetHeight(), aLocationMM.GetHeight() );
2066
>>> CID 1451636: (DIVIDE_BY_ZERO)
>>> In function call "operator *", modulo by expression "aScaleX.mnNumerator" which may be zero has undefined behavior.
2067 long nX1 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
2068 long nX2 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
2069 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
2070 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071
2072 if ( nX1 > aLocationPixel.Right() ) nX1 = aLocationPixel.Right();
** CID 1451635: Null pointer dereferences (FORWARD_NULL)
/cui/source/dialogs/SpellDialog.cxx: 1484 in svx::SentenceEditWindow_Impl::KeyInput(const KeyEvent &)()
________________________________________________________________________________________________________
*** CID 1451635: Null pointer dereferences (FORWARD_NULL)
/cui/source/dialogs/SpellDialog.cxx: 1484 in svx::SentenceEditWindow_Impl::KeyInput(const KeyEvent &)()
1478 {
1479 m_nErrorStart = pFontColor->nStart;
1480 m_nErrorEnd = pFontColor->nEnd;
1481 if (pErrorAttrib->nStart != m_nErrorStart || pErrorAttrib->nEnd != m_nErrorEnd)
1482 {
1483 std::unique_ptr<SfxPoolItem> xNewError(pErrorAttrib->pAttr->Clone());
>>> CID 1451635: Null pointer dereferences (FORWARD_NULL)
>>> Dereferencing null pointer "pErrorAttr".
1484 m_xEditEngine->RemoveAttribs(ESelection(0, pErrorAttr->nStart, 0, pErrorAttr->nEnd), false, EE_CHAR_GRABBAG);
1485 SetAttrib(*xNewError, m_nErrorStart, m_nErrorEnd);
1486 }
1487 }
1488 }
1489 //this is not a modification anymore
** CID 1451634: (DIVIDE_BY_ZERO)
________________________________________________________________________________________________________
*** CID 1451634: (DIVIDE_BY_ZERO)
/sc/source/ui/unoobj/docuno.cxx: 2069 in ScModelObj::render(int, const com::sun::star::uno::Any &, const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2063
2064 Fraction aScaleX( aLocationPixel.GetWidth(), aLocationMM.GetWidth() );
2065 Fraction aScaleY( aLocationPixel.GetHeight(), aLocationMM.GetHeight() );
2066
2067 long nX1 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
2068 long nX2 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
>>> CID 1451634: (DIVIDE_BY_ZERO)
>>> In function call "operator *", modulo by expression "aScaleY.mnNumerator" which may be zero has undefined behavior.
2069 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
2070 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071
2072 if ( nX1 > aLocationPixel.Right() ) nX1 = aLocationPixel.Right();
2073 if ( nX2 > aLocationPixel.Right() ) nX2 = aLocationPixel.Right();
2074 if ( nY1 > aLocationPixel.Bottom() ) nY1 = aLocationPixel.Bottom();
/sc/source/ui/unoobj/docuno.cxx: 2070 in ScModelObj::render(int, const com::sun::star::uno::Any &, const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2064 Fraction aScaleX( aLocationPixel.GetWidth(), aLocationMM.GetWidth() );
2065 Fraction aScaleY( aLocationPixel.GetHeight(), aLocationMM.GetHeight() );
2066
2067 long nX1 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
2068 long nX2 = aLocationPixel.Left() + static_cast<long>( Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
2069 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
>>> CID 1451634: (DIVIDE_BY_ZERO)
>>> In function call "operator *", modulo by expression "aScaleY.mnNumerator" which may be zero has undefined behavior.
2070 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071
2072 if ( nX1 > aLocationPixel.Right() ) nX1 = aLocationPixel.Right();
2073 if ( nX2 > aLocationPixel.Right() ) nX2 = aLocationPixel.Right();
2074 if ( nY1 > aLocationPixel.Bottom() ) nY1 = aLocationPixel.Bottom();
2075 if ( nY2 > aLocationPixel.Bottom() ) nY2 = aLocationPixel.Bottom();
** CID 1451633: Memory - illegal accesses (USE_AFTER_FREE)
________________________________________________________________________________________________________
*** CID 1451633: Memory - illegal accesses (USE_AFTER_FREE)
/sw/source/core/layout/paintfrm.cxx: 4101 in SwFlyFrame::PaintSwFrame(OutputDevice &, const SwRect &, const SwPrintData *) const()
4095 gProp.pSSpecSubsLines.reset();
4096 }
4097 }
4098
4099 SwLayoutFrame::PaintSwFrame( rRenderContext, aRect );
4100
>>> CID 1451633: Memory - illegal accesses (USE_AFTER_FREE)
>>> Calling "Validate" dereferences freed pointer "this".
4101 Validate();
4102
4103 // OD 19.12.2002 #106318# - first paint lines added by fly frame paint
4104 // and then unlock other lines.
4105 gProp.pSLines->PaintLines( &rRenderContext, gProp );
4106 gProp.pSLines->LockLines( false );
** CID 1451632: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1451632: Null pointer dereferences (FORWARD_NULL)
/sd/source/ui/view/sdwindow.cxx: 271 in sd::Window::Command(const CommandEvent &)()
265 //pass at least alt press/release to parent impl
266 if (rCEvt.GetCommand() == CommandEventId::ModKeyChange)
267 vcl::Window::Command(rCEvt);
268 //show the text edit outliner view cursor
269 else if (!HasFocus() && rCEvt.GetCommand() == CommandEventId::CursorPos)
270 {
>>> CID 1451632: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "this->mpViewShell" to "GetView", which dereferences it.
271 OutlinerView* pOLV = mpViewShell->GetView()->GetTextEditOutlinerView();
272 if (pOLV && this == pOLV->GetWindow())
273 {
274 GrabFocus();
275 pOLV->ShowCursor();
276 }
** CID 1451630: Integer handling issues (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 153 in vcl::<unnamed>::ImplScaleConvolutionHor(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()
________________________________________________________________________________________________________
*** CID 1451630: Integer handling issues (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 153 in vcl::<unnamed>::ImplScaleConvolutionHor(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()
147
148 aValueRed += aWeight * aColor.GetRed();
149 aValueGreen += aWeight * aColor.GetGreen();
150 aValueBlue += aWeight * aColor.GetBlue();
151 }
152
>>> CID 1451630: Integer handling issues (DIVIDE_BY_ZERO)
>>> In expression "aValueRed / aSum", division by expression "aSum" which may be zero has undefined behavior.
153 const BitmapColor aResultColor(
154 static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueRed / aSum), 0, 255)),
155 static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueGreen / aSum), 0, 255)),
156 static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueBlue / aSum), 0, 255)));
157
158 pWriteAcc->SetPixelOnData(pScanline, x, aResultColor);
** CID 1451629: Integer handling issues (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 234 in vcl::<unnamed>::ImplScaleConvolutionVer(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()
________________________________________________________________________________________________________
*** CID 1451629: Integer handling issues (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 234 in vcl::<unnamed>::ImplScaleConvolutionVer(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()
228 const BitmapColor & aColor = aScanline[aPixels[aIndex]];
229 aValueRed += aWeight * aColor.GetRed();
230 aValueGreen += aWeight * aColor.GetGreen();
231 aValueBlue += aWeight * aColor.GetBlue();
232 }
233
>>> CID 1451629: Integer handling issues (DIVIDE_BY_ZERO)
>>> In expression "aValueRed / aSum", division by expression "aSum" which may be zero has undefined behavior.
234 const BitmapColor aResultColor(
235 static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueRed / aSum), 0, 255)),
236 static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueGreen / aSum), 0, 255)),
237 static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueBlue / aSum), 0, 255)));
238
239 if(pWriteAcc->HasPalette())
** CID 1451628: Null pointer dereferences (FORWARD_NULL)
________________________________________________________________________________________________________
*** CID 1451628: Null pointer dereferences (FORWARD_NULL)
/sc/source/ui/Accessibility/AccessibleDocument.cxx: 300 in ScChildrenShapes::ScChildrenShapes(ScAccessibleDocument *, ScTabViewShell *, ScSplitPos)()
294 }
295 }
296 }
297
298 maZOrderedShapes.push_back(nullptr); // add an element which represents the table
299
>>> CID 1451628: Null pointer dereferences (FORWARD_NULL)
>>> "GetCount" dereferences null "this->mpAccessibleDocument".
300 GetCount(); // fill list with filtered shapes (no internal shapes)
301
302 if (mnShapesSelected)
303 {
304 //set flag on every selected shape
305 if (!xSelectionSupplier.is())
** CID 1451627: (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 86 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 116 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 77 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 54 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 65 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 108 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
________________________________________________________________________________________________________
*** CID 1451627: (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 86 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
80 aRelativePosition.Secondary =
81 static_cast< double >( aAnchor.Y()) /
82 static_cast< double >( aPageRect.getHeight());
83
84 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
85
>>> CID 1451627: (DIVIDE_BY_ZERO)
>>> In expression "static_cast<double>(aObjectRect.getWidth()) / static_cast<double>(aPageRect.getWidth())", division by expression "aPageRect.getWidth()" which may be zero has undefined behavior.
86 aRelativeSize.Primary =
87 static_cast< double >( aObjectRect.getWidth()) /
88 static_cast< double >( aPageRect.getWidth() );
89 if (aRelativeSize.Primary > 1.0)
90 aRelativeSize.Primary = 1.0;
91 aRelativeSize.Secondary =
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 116 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
110 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
111
112 //set size:
113 RelativeSize aRelativeSize;
114 //the anchor points for the diagram are in the middle of the diagram
115 //and in the middle of the page
>>> CID 1451627: (DIVIDE_BY_ZERO)
>>> In expression "(double)aObjectRect.getWidth() / (double)aPageRect.getWidth()", division by expression "aPageRect.getWidth()" which may be zero has undefined behavior.
116 aRelativeSize.Primary = double(aObjectRect.getWidth())/double(aPageRect.getWidth());
117 aRelativeSize.Secondary = double(aObjectRect.getHeight())/double(aPageRect.getHeight());
118 xObjectProp->setPropertyValue( "RelativeSize", uno::Any(aRelativeSize) );
119 }
120 else
121 return false;
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 77 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
71 xObjectProp->setPropertyValue( "AnchorPosition", uno::Any(LegendPosition_CUSTOM));
72 xObjectProp->setPropertyValue( "Expansion", uno::Any(css::chart::ChartLegendExpansion_CUSTOM));
73 chart2::RelativePosition aRelativePosition;
74 chart2::RelativeSize aRelativeSize;
75 Point aAnchor = aObjectRect.TopLeft();
76
>>> CID 1451627: (DIVIDE_BY_ZERO)
>>> In expression "static_cast<double>(aAnchor.X()) / static_cast<double>(aPageRect.getWidth())", division by expression "aPageRect.getWidth()" which may be zero has undefined behavior.
77 aRelativePosition.Primary =
78 static_cast< double >( aAnchor.X()) /
79 static_cast< double >( aPageRect.getWidth() );
80 aRelativePosition.Secondary =
81 static_cast< double >( aAnchor.Y()) /
82 static_cast< double >( aPageRect.getHeight());
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 54 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
48 {
49 //@todo decide whether x is primary or secondary
50 chart2::RelativePosition aRelativePosition;
51 aRelativePosition.Anchor = drawing::Alignment_CENTER;
52 //the anchor point at the title object is top/middle
53 Point aPos = aObjectRect.TopLeft();
>>> CID 1451627: (DIVIDE_BY_ZERO)
>>> In expression "((double)aPos.X() + (double)aObjectRect.getWidth() / 2.) / (double)aPageRect.getWidth()", division by expression "aPageRect.getWidth()" which may be zero has undefined behavior.
54 aRelativePosition.Primary = (double(aPos.X())+double(aObjectRect.getWidth())/2.0)/double(aPageRect.getWidth());
55 aRelativePosition.Secondary = (double(aPos.Y())+double(aObjectRect.getHeight())/2.0)/double(aPageRect.getHeight());
56 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
57 }
58 else if( eObjectType==OBJECTTYPE_DATA_CURVE_EQUATION )
59 {
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 65 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
59 {
60 //@todo decide whether x is primary or secondary
61 chart2::RelativePosition aRelativePosition;
62 aRelativePosition.Anchor = drawing::Alignment_TOP_LEFT;
63 //the anchor point at the title object is top/middle
64 Point aPos = aObjectRect.TopLeft();
>>> CID 1451627: (DIVIDE_BY_ZERO)
>>> In expression "(double)aPos.X() / (double)aPageRect.getWidth()", division by expression "aPageRect.getWidth()" which may be zero has undefined behavior.
65 aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
66 aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
67 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
68 }
69 else if(eObjectType==OBJECTTYPE_LEGEND)
70 {
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 108 in chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
102
103 //set position:
104 chart2::RelativePosition aRelativePosition;
105 aRelativePosition.Anchor = drawing::Alignment_CENTER;
106
107 Point aPos = aObjectRect.Center();
>>> CID 1451627: (DIVIDE_BY_ZERO)
>>> In expression "(double)aPos.X() / (double)aPageRect.getWidth()", division by expression "aPageRect.getWidth()" which may be zero has undefined behavior.
108 aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
109 aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
110 xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
111
112 //set size:
113 RelativeSize aRelativeSize;
** CID 1451626: (UNCAUGHT_EXCEPT)
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()
________________________________________________________________________________________________________
*** CID 1451626: (UNCAUGHT_EXCEPT)
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()
3287 {
3288 SwViewShell* pViewShell = _pKeepThisFlyFrame->getRootFrame()->GetCurrShell();
3289 mpWrtShell = dynamic_cast<SwWrtShell*>(pViewShell);
3290 }
3291 }
3292
>>> CID 1451626: (UNCAUGHT_EXCEPT)
>>> An exception of type "com::sun::star::uno::DeploymentException" is thrown but the throw list "noexcept" doesn't allow it to be thrown. This will cause a call to unexpected() which usually calls terminate().
3293 SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()
3294 {
3295 if ( mbAnchorNodeChanged )
3296 {
3297 mrFlyFrameFormat.MakeFrames();
3298 }
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()
3287 {
3288 SwViewShell* pViewShell = _pKeepThisFlyFrame->getRootFrame()->GetCurrShell();
3289 mpWrtShell = dynamic_cast<SwWrtShell*>(pViewShell);
3290 }
3291 }
3292
>>> CID 1451626: (UNCAUGHT_EXCEPT)
>>> An exception of type "com::sun::star::uno::DeploymentException" is thrown but the throw list "noexcept" doesn't allow it to be thrown. This will cause a call to unexpected() which usually calls terminate().
3293 SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()
3294 {
3295 if ( mbAnchorNodeChanged )
3296 {
3297 mrFlyFrameFormat.MakeFrames();
3298 }
** CID 1451625: Null pointer dereferences (FORWARD_NULL)
/sw/source/filter/ww8/docxattributeoutput.cxx: 1936 in DocxAttributeOutput::StartField_Impl(const SwTextNode *, int, const FieldInfos &, bool)()
________________________________________________________________________________________________________
*** CID 1451625: Null pointer dereferences (FORWARD_NULL)
/sw/source/filter/ww8/docxattributeoutput.cxx: 1936 in DocxAttributeOutput::StartField_Impl(const SwTextNode *, int, const FieldInfos &, bool)()
1930 if(!sCurrentDate.isEmpty())
1931 {
1932 sFullDate = sCurrentDate + "T00:00:00Z";
1933 }
1934 else
1935 {
>>> CID 1451625: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "pFieldmark" to "GetCurrentDate", which dereferences it. (The dereference happens because this is a virtual function call.)
1936 std::pair<bool, double> aResult = pFieldmark->GetCurrentDate();
1937 if(aResult.first)
1938 {
1939 sFullDate = pFieldmark->GetDateInStandardDateFormat(aResult.second) + "T00:00:00Z";
1940 }
1941 }
** CID 1424266: Error handling issues (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 270 in std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::~unique_ptr()()
________________________________________________________________________________________________________
*** CID 1424266: Error handling issues (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 270 in std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::~unique_ptr()()
264 is_convertible<_Up*, _Tp*>, is_same<_Dp, default_delete<_Tp>>>>
265 unique_ptr(auto_ptr<_Up>&& __u) noexcept;
266 #pragma GCC diagnostic pop
267 #endif
268
269 /// Destructor, invokes the deleter if the stored pointer is not null.
>>> CID 1424266: Error handling issues (UNCAUGHT_EXCEPT)
>>> An exception of type "std::bad_weak_ptr" is thrown but the throw list "noexcept" doesn't allow it to be thrown. This will cause a call to unexpected() which usually calls terminate().
270 ~unique_ptr() noexcept
271 {
272 auto& __ptr = _M_t._M_ptr();
273 if (__ptr != nullptr)
274 get_deleter()(__ptr);
275 __ptr = pointer();
** CID 1424263: Error handling issues (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 377 in std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::reset(sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext *)()
________________________________________________________________________________________________________
*** CID 1424263: Error handling issues (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 377 in std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::reset(sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext *)()
371 *
372 * @param __p The new pointer to store.
373 *
374 * The deleter will be invoked if a pointer is already owned.
375 */
376 void
>>> CID 1424263: Error handling issues (UNCAUGHT_EXCEPT)
>>> An exception of type "std::bad_weak_ptr" is thrown but the throw list "noexcept" doesn't allow it to be thrown. This will cause a call to unexpected() which usually calls terminate().
377 reset(pointer __p = pointer()) noexcept
378 {
379 using std::swap;
380 swap(_M_t._M_ptr(), __p);
381 if (__p != pointer())
382 get_deleter()(__p);
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRZBnDJeNb0HijxaS4JNJPxk3kpyAm2AYqo71yXmnOxB73RtgzoPcQtNNP5dkHLuV1E-3D_g-2BrHdvqzaBa155F-2F8AmPhpJzY63UzWDisJV95WUBpGhqFw1ICExHG8aMaV2EoFpytTbOCofUyNuZQRI0eDeAdRCgPqu5DpWTM655rfs5CQwrGncXSn-2B5ueJXbaY-2BycpYrUIk8kL94p0feydPrgc0oOLLuMHsvzwg56DfD-2Fm4kz8ENew5w-2Fz6Xy2LDn7v8ITk-2B-2FcJ9DzOFtUvi05B97DzuEVER3pXltGNySi0KKNMn5k-3D
More information about the LibreOffice
mailing list