New Defects reported by Coverity Scan for LibreOffice

[scan-admin at coverity.com]

Hi,

Please find the latest report on new defect(s) introduced to LibreOffice found with Coverity Scan.

3 new defect(s) introduced to LibreOffice found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)


** CID 1472568:  Integer handling issues  (DIVIDE_BY_ZERO)
/sc/source/core/data/table2.cxx: 4011 in ScTable::GetRowForHeight(long) const()


________________________________________________________________________________________________________
*** CID 1472568:  Integer handling issues  (DIVIDE_BY_ZERO)
/sc/source/core/data/table2.cxx: 4011 in ScTable::GetRowForHeight(long) const()
4005             tools::Long nPixelsLeft = nHeight - nSum;
4006             tools::Long nCommonPixels = aRowHeightRange.mnValue * nCommon;
4007     
4008             // are we in the zone ?
4009             if (nCommonPixels > nPixelsLeft)
4010             {
>>>     CID 1472568:  Integer handling issues  (DIVIDE_BY_ZERO)
>>>     In expression "(nPixelsLeft + aRowHeightRange.mnValue - 1L) / aRowHeightRange.mnValue", division by expression "aRowHeightRange.mnValue" which may be zero has undefined behavior.
4011                 nRow += (nPixelsLeft + aRowHeightRange.mnValue - 1) / aRowHeightRange.mnValue;
4012     
4013                 // FIXME: finding this next row is far from elegant,
4014                 // we have a single caller, which subtracts one as well(!?)
4015                 if (nRow >= rDocument.MaxRow())
4016                     return rDocument.MaxRow();

** CID 1472567:  Null pointer dereferences  (NULL_RETURNS)
/chart2/source/controller/main/ChartController_TextEdit.cxx: 101 in chart::ChartController::StartTextEdit(const Point *)()


________________________________________________________________________________________________________
*** CID 1472567:  Null pointer dereferences  (NULL_RETURNS)
/chart2/source/controller/main/ChartController_TextEdit.cxx: 101 in chart::ChartController::StartTextEdit(const Point *)()
95                 pOutlinerView->MouseButtonUp( aEditEvt );
96             }
97         }
98     
99         //we invalidate the outliner region because the outliner has some
100         //paint problems (some characters are painted twice a little bit shifted)
>>>     CID 1472567:  Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "nullptr" "this->GetChartWindow()" when calling "Invalidate". (The dereference happens because this is a virtual function call.)
101         GetChartWindow()->Invalidate( m_pDrawViewWrapper->GetMarkedObjBoundRect() );
102     }
103     
104     bool ChartController::EndTextEdit()
105     {
106         m_pDrawViewWrapper->SdrEndTextEdit();

** CID 1472566:  Integer handling issues  (SIGN_EXTENSION)
/sc/source/core/data/table2.cxx: 4006 in ScTable::GetRowForHeight(long) const()


________________________________________________________________________________________________________
*** CID 1472566:  Integer handling issues  (SIGN_EXTENSION)
/sc/source/core/data/table2.cxx: 4006 in ScTable::GetRowForHeight(long) const()
4000             SCROW nLastCommon = std::min(aData.mnRow2, aRowHeightRange.mnRow2);
4001             assert (nLastCommon >= nRow);
4002             SCROW nCommon = nLastCommon - nRow + 1;
4003     
4004             // how much further to go ?
4005             tools::Long nPixelsLeft = nHeight - nSum;
>>>     CID 1472566:  Integer handling issues  (SIGN_EXTENSION)
>>>     Suspicious implicit sign extension: "aRowHeightRange.mnValue" with type "sal_uInt16" (16 bits, unsigned) is promoted in "aRowHeightRange.mnValue * nCommon" to type "int" (32 bits, signed), then sign-extended to type "long" (64 bits, signed).  If "aRowHeightRange.mnValue * nCommon" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
4006             tools::Long nCommonPixels = aRowHeightRange.mnValue * nCommon;
4007     
4008             // are we in the zone ?
4009             if (nCommonPixels > nPixelsLeft)
4010             {
4011                 nRow += (nPixelsLeft + aRowHeightRange.mnValue - 1) / aRowHeightRange.mnValue;


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50ypSs1kiFPuCn2xFdlMIFBirii0zZ9j2-2F9F2XPBcBm2BNgi9duPy3v-2FzgFDd2LJ-2BDKI-3DrTjK_OTq2XUZbbipYjyLSo6GRo-2FpVxQ9OzkDINu9UTS-2FQhSdO0F0jQniitrGlNxDIzPJihwUEFQgPb0bXIjlPUTLWQt6yWBCWN4ds0q3ZcO3SF25mJNGNSfy-2BYOcyHF6eWo6sm5Z3DgYQRpGkhTwttKIgd2RnwwbhyjYDzXB9TgNQ2lLY60a-2BPgz5cEtp22JzsU7RXGY-2BjyY-2FE9RP159fvzSiH3q6sbn0HsSYcfMPtl1l3jGWiS5v0Golk5CZd0xuVnXk