New Defects reported by Coverity Scan for LibreOffice

scan-admin at coverity.com scan-admin at coverity.com
Wed Jul 30 09:02:55 UTC 2025


Hi,

Please find the latest report on new defect(s) introduced to LibreOffice found with Coverity Scan.

26 new defect(s) introduced to LibreOffice found with Coverity Scan.
187 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 26 defect(s)


** CID 1660823:       Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 893           in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 1)]::operator ()(int) const()


_____________________________________________________________________________________________
*** CID 1660823:         Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 893             in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 1)]::operator ()(int) const()
887                     pDev = &SmModule::get()->GetDefaultVirtualDev();
888                 OSL_ENSURE (pDev, "device for font list missing" );
889     
890                 auto pFontTypeDialog = std::make_shared<SmFontTypeDialog>(rReq.GetFrameWeld(), pDev);
891                 SmFormat aOldFormat  = GetFormat();
892                 pFontTypeDialog->ReadFrom( aOldFormat );
>>>     CID 1660823:         Performance inefficiencies  (PASS_BY_VALUE)
>>>     Capturing variable "aOldFormat" of type "SmFormat" (size 344 bytes) by value, which exceeds the medium threshold of 256 bytes.
893                 weld::DialogController::runAsync( pFontTypeDialog, [aOldFormat, pFontTypeDialog, this](sal_Int32 nResult) {
894                     if (nResult == RET_OK)
895                     {
896                         SmFormat aNewFormat( aOldFormat );
897                         pFontTypeDialog->WriteTo(aNewFormat);
898     

** CID 1660822:       Memory - corruptions  (MULTIPLE_INIT_SMART_PTRS)


_____________________________________________________________________________________________
*** CID 1660822:         Memory - corruptions  (MULTIPLE_INIT_SMART_PTRS)
/sw/source/core/text/txtfrm.cxx: 3724             in SwTextFrame::CalcFitToContent()()
3718     
3719         {
3720             SwFrameAreaDefinition::FramePrintAreaWriteAccess aPrt(*this);
3721             aPrt.Width( nOldPrtWidth );
3722         }
3723     
>>>     CID 1660822:         Memory - corruptions  (MULTIPLE_INIT_SMART_PTRS)
>>>     Function "SetPara" sets a smart pointer with "pOldPara", but it is already managed by another smart pointer.
3724         SetPara( pOldPara );
3725     
3726         // tdf#164932 handle numbering list offset
3727         const SwTextNode* pTextNode( GetTextNodeForParaProps() );
3728         SwTwips nNumOffset = 0;
3729         if ( pTextNode->IsNumbered(getRootFrame()) &&

** CID 1660821:       Null pointer dereferences  (NULL_RETURNS)


_____________________________________________________________________________________________
*** CID 1660821:         Null pointer dereferences  (NULL_RETURNS)
/vcl/source/control/fmtfield.cxx: 820             in Formatter::ParseText(const rtl::OUString &)()
814     
815             // special treatment for percentage formatting
816             OUString sText = rText;
817             if (GetOrCreateFormatter().GetType(m_nFormatKey) == SvNumFormatType::PERCENT)
818             {
819                 // the language of our format
>>>     CID 1660821:         Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "nullptr" "this->m_pFormatter->GetEntry(this->m_nFormatKey)" when calling "GetLanguage".
820                 LanguageType eLanguage = m_pFormatter->GetEntry(m_nFormatKey)->GetLanguage();
821                 // the default number format for this language
822                 sal_uLong nStandardNumericFormat = m_pFormatter->GetStandardFormat(SvNumFormatType::NUMBER, eLanguage);
823     
824                 sal_uInt32 nTempFormat = nStandardNumericFormat;
825                 double dTemp;

** CID 1660820:       Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 962           in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 4)]::operator ()(int) const()


_____________________________________________________________________________________________
*** CID 1660820:         Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 962             in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 4)]::operator ()(int) const()
956     
957             case SID_ALIGN:
958             {
959                 auto pAlignDialog = std::make_shared<SmAlignDialog>(rReq.GetFrameWeld());
960                 SmFormat aOldFormat  = GetFormat();
961                 pAlignDialog->ReadFrom( aOldFormat );
>>>     CID 1660820:         Performance inefficiencies  (PASS_BY_VALUE)
>>>     Capturing variable "aOldFormat" of type "SmFormat" (size 344 bytes) by value, which exceeds the medium threshold of 256 bytes.
962                 weld::DialogController::runAsync(pAlignDialog, [aOldFormat, pAlignDialog, this](sal_Int32 nResult) {
963                     if (nResult == RET_OK)
964                     {
965                         SmFormat aNewFormat( aOldFormat );
966                         pAlignDialog->WriteTo(aNewFormat);
967     

** CID 1660819:       Error handling issues  (CHECKED_RETURN)
/sw/source/core/doc/gctable.cxx: 363           in lcl_MergeGCBox(SwTableBox *, <unnamed>::GCLinePara *)()


_____________________________________________________________________________________________
*** CID 1660819:         Error handling issues  (CHECKED_RETURN)
/sw/source/core/doc/gctable.cxx: 363             in lcl_MergeGCBox(SwTableBox *, <unnamed>::GCLinePara *)()
357                 SwTableLine* pCpyLine = pTableBox->GetTabLines()[0];
358                 SwTableBoxes::iterator it = std::find( pInsLine->GetTabBoxes().begin(), pInsLine->GetTabBoxes().end(), pTableBox );
359                 for( auto pTabBox : pCpyLine->GetTabBoxes() )
360                     pTabBox->SetUpper( pInsLine );
361     
362                 SfxPoolItem const* pRowBrush(nullptr);
>>>     CID 1660819:         Error handling issues  (CHECKED_RETURN)
>>>     Calling "GetItemState" without checking return value (as is done elsewhere 12 out of 15 times).
363                 pCpyLine->GetFrameFormat()->GetItemState(RES_BACKGROUND, true, &pRowBrush);
364                 if (pRowBrush)
365                 {
366                     for (auto pBox : pCpyLine->GetTabBoxes())
367                     {
368                         if (pBox->GetFrameFormat()->GetItemState(RES_BACKGROUND) != SfxItemState::SET)

** CID 1660818:       Null pointer dereferences  (NULL_RETURNS)


_____________________________________________________________________________________________
*** CID 1660818:         Null pointer dereferences  (NULL_RETURNS)
/sw/source/core/edit/edsect.cxx: 357             in lcl_SpecialInsertNode(const SwPosition *)()
351             {
352                 if (SectionType::ToxHeader == pSection->GetType())
353                 {
354                     if (const SwSection* pSectionParent = pSection->GetParent())
355                         pInnermostNode = pSectionParent->GetFormat()->GetSectionNode();
356                 }
>>>     CID 1660818:         Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "nullptr" "static_cast<SwSectionNode const *>(pInnermostNode)" when calling "IsInProtectSect".
357                 bIsProtected = static_cast<const SwSectionNode*>(pInnermostNode)->IsInProtectSect();
358             }
359     
360             // The previous version had a check to skip empty read-only sections. Those
361             // shouldn't occur, so we only need to check whether our pInnermostNode is
362             // inside a protected area.

** CID 1660817:       Null pointer dereferences  (REVERSE_INULL)
/sw/source/core/crsr/crsrsh.cxx: 2476           in SwCursorShell::UpdateCursor(unsigned short, bool, ScrollSizeMode)()


_____________________________________________________________________________________________
*** CID 1660817:         Null pointer dereferences  (REVERSE_INULL)
/sw/source/core/crsr/crsrsh.cxx: 2476             in SwCursorShell::UpdateCursor(unsigned short, bool, ScrollSizeMode)()
2470     
2471         // We should not restrict cursor update to the active view when using LOK
2472         bool bCheckFocus = m_bHasFocus || comphelper::LibreOfficeKit::isActive();
2473     
2474         if( !bIdleEnd && bCheckFocus && !m_bBasicHideCursor )
2475         {
>>>     CID 1660817:         Null pointer dereferences  (REVERSE_INULL)
>>>     Null-checking "this->m_pTableCursor" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
2476             if( m_pTableCursor )
2477                 m_pTableCursor->SwSelPaintRects::Show();
2478             else
2479             {
2480                 m_pCurrentCursor->SwSelPaintRects::Show();
2481                 if( m_pBlockCursor )

** CID 1660816:       Null pointer dereferences  (NULL_RETURNS)


_____________________________________________________________________________________________
*** CID 1660816:         Null pointer dereferences  (NULL_RETURNS)
/sw/source/core/doc/tblrwcl.cxx: 2985             in lcl_SetSelLineHeight(SwTableLine *, const <unnamed>::CR_SetLineHeight &, long, bool)()
2979         }
2980         else if( !rParam.bBigger )
2981         {
2982             // Calculate the new relative size by means of the old one
2983             SwLayoutFrame* pLineFrame = GetRowFrame( *pLine );
2984             OSL_ENSURE( pLineFrame, "Where is the Frame from the SwTableLine?" );
>>>     CID 1660816:         Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "nullptr" "pLineFrame" when calling "CalcRowRstHeight".
2985             SwTwips nRstHeight = CalcRowRstHeight( pLineFrame );
2986             if( (nRstHeight + ROWFUZZY) < nDist )
2987                 bRet = false;
2988         }
2989         return bRet;
2990     }

** CID 1660815:       Null pointer dereferences  (NULL_RETURNS)


_____________________________________________________________________________________________
*** CID 1660815:         Null pointer dereferences  (NULL_RETURNS)
/sw/source/ui/fldui/DateFormFieldDialog.cxx: 58             in sw::DateFormFieldDialog::Apply()()
52     
53         // Get date value first
54         std::pair<bool, double> aResult = m_pDateField->GetCurrentDate();
55     
56         // Then set the date format
57         (*pParameters)[ODF_FORMDATE_DATEFORMAT] <<= pFormat->GetFormatstring();
>>>     CID 1660815:         Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "nullptr" "pFormat" when calling "GetLanguage".
58         (*pParameters)[ODF_FORMDATE_DATEFORMAT_LANGUAGE]
59             <<= LanguageTag(pFormat->GetLanguage()).getBcp47();
60     
61         // Update current date
62         if (aResult.first)
63         {

** CID 1660814:       Null pointer dereferences  (NULL_RETURNS)


_____________________________________________________________________________________________
*** CID 1660814:         Null pointer dereferences  (NULL_RETURNS)
/sd/source/ui/view/drviews4.cxx: 170             in sd::DrawViewShell::DeleteActualLayer()()
164         std::unique_ptr<weld::MessageDialog> xQueryBox(Application::CreateMessageDialog(GetFrameWeld(),
165                                                        VclMessageType::Question, VclButtonsType::YesNo,
166                                                        aString));
167         if (xQueryBox->run() == RET_YES)
168         {
169             const SdrLayer* pLayer = rAdmin.GetLayer(aName);
>>>     CID 1660814:         Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "nullptr" "pLayer->GetName()" when calling "DeleteLayer".
170             mpDrawView->DeleteLayer( pLayer->GetName() );
171     
172             /* in order to redraw TabBar and Window; should be initiated later on by
173                a hint from Joe (as by a change if the layer order). */
174             // ( View::Notify() --> ViewShell::ResetActualLayer() )
175     

** CID 1660813:       Error handling issues  (UNCAUGHT_EXCEPT)
/sfx2/source/view/viewfrm.cxx: 2080           in SfxViewFrame::~SfxViewFrame()()


_____________________________________________________________________________________________
*** CID 1660813:         Error handling issues  (UNCAUGHT_EXCEPT)
/sfx2/source/view/viewfrm.cxx: 2080             in SfxViewFrame::~SfxViewFrame()()
2074         m_pImpl->pWindow = VclPtr<SfxFrameViewWindow_Impl>::Create( this, rFrame.GetWindow() );
2075         m_pImpl->pWindow->SetSizePixel( rFrame.GetWindow().GetOutputSizePixel() );
2076         rFrame.SetOwnsBindings_Impl( true );
2077         rFrame.CreateWorkWindow_Impl();
2078     }
2079     
>>>     CID 1660813:         Error handling issues  (UNCAUGHT_EXCEPT)
>>>     An exception of type "com::sun::star::lang::IllegalArgumentException" is thrown but the exception specification "/*implicit*/noexcept" doesn't allow it to be thrown. This will result in a call to terminate().
2080     SfxViewFrame::~SfxViewFrame()
2081     {
2082         m_pImpl->bIsDowning = true;
2083     
2084         if ( SfxViewFrame::Current() == this )
2085             SfxViewFrame::SetViewFrame( nullptr );

** CID 1660812:       Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 939           in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 3)]::operator ()(int) const()


_____________________________________________________________________________________________
*** CID 1660812:         Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 939             in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 3)]::operator ()(int) const()
933     
934             case SID_DISTANCE:
935             {
936                 auto pDistanceDialog = std::make_shared<SmDistanceDialog>(rReq.GetFrameWeld());
937                 SmFormat aOldFormat  = GetFormat();
938                 pDistanceDialog->ReadFrom( aOldFormat );
>>>     CID 1660812:         Performance inefficiencies  (PASS_BY_VALUE)
>>>     Capturing variable "aOldFormat" of type "SmFormat" (size 344 bytes) by value, which exceeds the medium threshold of 256 bytes.
939                 weld::DialogController::runAsync(pDistanceDialog, [aOldFormat, pDistanceDialog, this](sal_Int32 nResult) {
940                     if (nResult == RET_OK)
941                     {
942                         SmFormat aNewFormat( aOldFormat );
943                         pDistanceDialog->WriteTo(aNewFormat);
944     

** CID 1660811:       Error handling issues  (UNCAUGHT_EXCEPT)
/sc/source/ui/view/spelldialog.cxx: 55           in ScSpellDialogChildWindow::~ScSpellDialogChildWindow()()


_____________________________________________________________________________________________
*** CID 1660811:         Error handling issues  (UNCAUGHT_EXCEPT)
/sc/source/ui/view/spelldialog.cxx: 55             in ScSpellDialogChildWindow::~ScSpellDialogChildWindow()()
49         mbNeedNextObj( false ),
50         mbOldIdleEnabled(true)
51     {
52         Init();
53     }
54     
>>>     CID 1660811:         Error handling issues  (UNCAUGHT_EXCEPT)
>>>     An exception of type "std::out_of_range" is thrown but the exception specification "/*implicit*/noexcept" doesn't allow it to be thrown. This will result in a call to terminate().
55     ScSpellDialogChildWindow::~ScSpellDialogChildWindow()
56     {
57         Reset();
58     }
59     
60     SfxChildWinInfo ScSpellDialogChildWindow::GetInfo() const

** CID 1660810:         (UNCAUGHT_EXCEPT)
/sw/source/filter/xml/XMLRedlineImportHelper.cxx: 279           in XMLRedlineImportHelper::~XMLRedlineImportHelper()()
/sw/source/filter/xml/XMLRedlineImportHelper.cxx: 279           in XMLRedlineImportHelper::~XMLRedlineImportHelper()()


_____________________________________________________________________________________________
*** CID 1660810:           (UNCAUGHT_EXCEPT)
/sw/source/filter/xml/XMLRedlineImportHelper.cxx: 279             in XMLRedlineImportHelper::~XMLRedlineImportHelper()()
273         if( bHandleRecordChanges )
274         {
275             m_xModelPropertySet->setPropertyValue( g_sRecordChanges, Any(false) );
276         }
277     }
278     
>>>     CID 1660810:           (UNCAUGHT_EXCEPT)
>>>     An exception of type "boost::wrapexcept<boost::property_tree::json_parser::json_parser_error>" is thrown but the exception specification "/*implicit*/noexcept" doesn't allow it to be thrown. This will result in a call to terminate().
279     XMLRedlineImportHelper::~XMLRedlineImportHelper()
280     {
281         // delete all left over (and obviously incomplete) RedlineInfos (and map)
282         for( const auto& rEntry : m_aRedlineMap )
283         {
284             RedlineInfo* pInfo = rEntry.second;
/sw/source/filter/xml/XMLRedlineImportHelper.cxx: 279             in XMLRedlineImportHelper::~XMLRedlineImportHelper()()
273         if( bHandleRecordChanges )
274         {
275             m_xModelPropertySet->setPropertyValue( g_sRecordChanges, Any(false) );
276         }
277     }
278     
>>>     CID 1660810:           (UNCAUGHT_EXCEPT)
>>>     An exception of type "boost::wrapexcept<boost::property_tree::json_parser::json_parser_error>" is thrown but the exception specification "/*implicit*/noexcept" doesn't allow it to be thrown. This will result in a call to terminate().
279     XMLRedlineImportHelper::~XMLRedlineImportHelper()
280     {
281         // delete all left over (and obviously incomplete) RedlineInfos (and map)
282         for( const auto& rEntry : m_aRedlineMap )
283         {
284             RedlineInfo* pInfo = rEntry.second;

** CID 1660809:       Error handling issues  (UNCAUGHT_EXCEPT)
/sw/source/core/txtnode/ndtxt.cxx: 5415           in <unnamed>::HandleResetAttrAtTextNode::~HandleResetAttrAtTextNode()()


_____________________________________________________________________________________________
*** CID 1660809:         Error handling issues  (UNCAUGHT_EXCEPT)
/sw/source/core/txtnode/ndtxt.cxx: 5415             in <unnamed>::HandleResetAttrAtTextNode::~HandleResetAttrAtTextNode()()
5409                 mbUpdateListCount = mbUpdateListCount ||
5410                                     ( rWhich == RES_PARATR_LIST_ISCOUNTED &&
5411                                       !mrTextNode.IsCountedInList() );
5412             }
5413         }
5414     
>>>     CID 1660809:         Error handling issues  (UNCAUGHT_EXCEPT)
>>>     An exception of type "com::sun::star::uno::RuntimeException" is thrown but the exception specification "/*implicit*/noexcept" doesn't allow it to be thrown. This will result in a call to terminate().
5415         HandleResetAttrAtTextNode::~HandleResetAttrAtTextNode() COVERITY_NOEXCEPT_FALSE
5416         {
5417             if ( mbListStyleOrIdReset && !mrTextNode.IsInList() )
5418             {
5419                 // check, if in spite of the reset of the list style or the list id
5420                 // the paragraph still has to be added to a list.

** CID 1660808:       Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 916           in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 2)]::operator ()(int) const()


_____________________________________________________________________________________________
*** CID 1660808:         Performance inefficiencies  (PASS_BY_VALUE)
/starmath/source/document.cxx: 916             in SmDocShell::Execute(SfxRequest &)::[lambda(int) (instance 2)]::operator ()(int) const()
910     
911             case SID_FONTSIZE:
912             {
913                 auto pFontSizeDialog = std::make_shared<SmFontSizeDialog>(rReq.GetFrameWeld());
914                 SmFormat aOldFormat  = GetFormat();
915                 pFontSizeDialog->ReadFrom( aOldFormat );
>>>     CID 1660808:         Performance inefficiencies  (PASS_BY_VALUE)
>>>     Capturing variable "aOldFormat" of type "SmFormat" (size 344 bytes) by value, which exceeds the medium threshold of 256 bytes.
916                 weld::DialogController::runAsync(pFontSizeDialog, [aOldFormat, pFontSizeDialog, this](sal_Int32 nResult) {
917                     if (nResult == RET_OK)
918                     {
919                         SmFormat aNewFormat( aOldFormat );
920                         pFontSizeDialog->WriteTo(aNewFormat);
921     

** CID 1660807:       Error handling issues  (UNCAUGHT_EXCEPT)
/sw/source/core/ole/ndole.cxx: 308           in SwOLENode::~SwOLENode()()


_____________________________________________________________________________________________
*** CID 1660807:         Error handling issues  (UNCAUGHT_EXCEPT)
/sw/source/core/ole/ndole.cxx: 308             in SwOLENode::~SwOLENode()()
302         mbOLESizeInvalid( false ),
303         mpObjectLink( nullptr )
304     {
305         maOLEObj.SetNode( this );
306     }
307     
>>>     CID 1660807:         Error handling issues  (UNCAUGHT_EXCEPT)
>>>     An exception of type "com::sun::star::uno::RuntimeException" is thrown but the exception specification "/*implicit*/noexcept" doesn't allow it to be thrown. This will result in a call to terminate().
308     SwOLENode::~SwOLENode()
309     {
310         DisconnectFileLink_Impl();
311         ResetAttr(RES_PAGEDESC);
312     }
313     

** CID 1660806:       Insecure data handling  (INTEGER_OVERFLOW)
/vcl/source/accessibility/vclxaccessibletoolbox.cxx: 264           in VCLXAccessibleToolBox::UpdateCustomPopupItemp_Impl(vcl::Window *, bool)()


_____________________________________________________________________________________________
*** CID 1660806:         Insecure data handling  (INTEGER_OVERFLOW)
/vcl/source/accessibility/vclxaccessibletoolbox.cxx: 264             in VCLXAccessibleToolBox::UpdateCustomPopupItemp_Impl(vcl::Window *, bool)()
258             // Moreover, calling GetItemPos with 0 will find a separator if there is any.
259             return;
260     
261         rtl::Reference<comphelper::OAccessible> pChild = pWindow->GetAccessible();
262         if (pChild.is())
263         {
>>>     CID 1660806:         Insecure data handling  (INTEGER_OVERFLOW)
>>>     The cast of "pToolBox->GetItemPos(nDownItem)" to a signed type could result in a negative number.
264             Reference< XAccessible > xChildItem( getAccessibleChild(pToolBox->GetItemPos(nDownItem)));
265             VCLXAccessibleToolBoxItem* pItem = static_cast< VCLXAccessibleToolBoxItem* >( xChildItem.get() );
266     
267             pItem->SetChild(pChild);
268             pItem->NotifyChildEvent(pChild, bOpen);
269         }

** CID 1660805:       Error handling issues  (CHECKED_RETURN)
/sw/source/filter/html/swhtml.cxx: 2041           in SwHTMLParser::NextToken(HtmlTokenId)()


_____________________________________________________________________________________________
*** CID 1660805:         Error handling issues  (CHECKED_RETURN)
/sw/source/filter/html/swhtml.cxx: 2041             in SwHTMLParser::NextToken(HtmlTokenId)()
2035                     {
2036                         const OUString& rDir = rOption.GetString();
2037                         SfxItemSet aItemSet( m_xDoc->GetAttrPool(),
2038                                              m_pCSS1Parser->GetWhichMap() );
2039                         SvxCSS1PropertyInfo aPropInfo;
2040                         OUString aDummy;
>>>     CID 1660805:         Error handling issues  (CHECKED_RETURN)
>>>     Calling "ParseStyleOptions" without checking return value (as is done elsewhere 16 out of 17 times).
2041                         ParseStyleOptions( aDummy, aDummy, aDummy, aItemSet,
2042                                            aPropInfo, nullptr, &rDir );
2043     
2044                         m_pCSS1Parser->SetPageDescAttrs( nullptr, &aItemSet );
2045                         break;
2046                     }

** CID 1660804:       Null pointer dereferences  (NULL_RETURNS)


_____________________________________________________________________________________________
*** CID 1660804:         Null pointer dereferences  (NULL_RETURNS)
/sw/source/core/undo/unattr.cxx: 399             in SwUndoFormatAttr::PutAttr(const SfxPoolItem &, const SwDoc &)()
393             return; // tdf#126017 never save SwNodeIndex, it will go stale
394         }
395         m_oOldSet->Put( rItem );
396         if ( RES_ANCHOR == rItem.Which() )
397         {
398             SwFormat * pFormat = GetFormat( rDoc );
>>>     CID 1660804:         Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "nullptr" "pFormat" when calling "SaveFlyAnchor".
399             SaveFlyAnchor( pFormat, m_bSaveDrawPt );
400         }
401     }
402     
403     void SwUndoFormatAttr::SaveFlyAnchor( const SwFormat * pFormat, bool bSvDrwPt )
404     {


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/libreoffice?tab=overview

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice/attachments/20250730/71c226a4/attachment.htm>


More information about the LibreOffice mailing list