Kaydet (Commit) 8fcd4bf3 authored tarafından Tushar Bende's avatar Tushar Bende Kaydeden (comit) Caolán McNamara

fdo#79535 :LO writer crash while Opening some document.

Problem Description : While setting ExtraData for Redline LO calls SwRangeRedline::SetExtraData() with
argument of type SwRedlineExtraData_FormattingChanges* which contains SfxItemSet*
In function SwRedlineExtraData_FormattingChanges() without Null checking SfxItemSet*,
LO was trying to get rCpy.pSet->Count() which was the reason for segmentation fault
while opening some documents in LO.

Added Null check before accessing a pointer.

Change-Id: I33299d2be2777ab6a8af0621595c9453145f1069
Reviewed-on: https://gerrit.libreoffice.org/9647Reviewed-by: 's avatarCaolán McNamara <caolanm@redhat.com>
Tested-by: 's avatarCaolán McNamara <caolanm@redhat.com>
üst d595e5ec
......@@ -2153,6 +2153,17 @@ DECLARE_OOXMLIMPORT_TEST(testFdo78883, "fdo78883.docx")
CPPUNIT_ASSERT_EQUAL(sal_Int16(1), xCursor->getPage());
}
DECLARE_OOXMLIMPORT_TEST(testFdo79535, "fdo79535.docx")
{
// fdo#79535 : LO was crashing while opening document
// Checking there is a single page after loading a doc successfully in LO.
uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
uno::Reference<text::XTextViewCursorSupplier> xTextViewCursorSupplier(xModel->getCurrentController(), uno::UNO_QUERY);
uno::Reference<text::XPageCursor> xCursor(xTextViewCursorSupplier->getViewCursor(), uno::UNO_QUERY);
xCursor->jumpToLastPage();
CPPUNIT_ASSERT_EQUAL(sal_Int16(1), xCursor->getPage());
}
DECLARE_OOXMLIMPORT_TEST(testBnc875718, "bnc875718.docx")
{
// The frame in the footer must not accidentally end up in the document body.
......
......@@ -3204,7 +3204,8 @@ SwRedlineExtraData_FormattingChanges::SwRedlineExtraData_FormattingChanges( cons
SwRedlineExtraData_FormattingChanges::SwRedlineExtraData_FormattingChanges( const SwRedlineExtraData_FormattingChanges& rCpy )
: SwRedlineExtraData()
{
if( rCpy.pSet->Count() )
// Checking pointer pSet before accessing it for Count
if( rCpy.pSet && rCpy.pSet->Count() )
{
pSet = new SfxItemSet( *(rCpy.pSet) );
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment