sw/source/core/layout/tabfrm.cxx | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
New commits:
commit 058fdc75afa9e5e69c6e11ab7879ddb9d51ae1c5
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Jun 13 15:55:33 2020 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Sat Jun 13 18:13:22 2020 +0200
crashtesting: null deref in SwCellFrame::GetLayoutRowSpan
seen with swtextframe_connectfootnote_heap_use_after_free.sample
Change-Id: I98da2e67065c5890d74e5f33ffc01329ff75f185
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96257
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 0a3e5f997357..2642c5018f1d 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -5366,7 +5366,8 @@ void SwCellFrame::Modify( const SfxPoolItem* pOld, const
SfxPoolItem * pNew )
long SwCellFrame::GetLayoutRowSpan() const
{
- long nRet = GetTabBox()->getRowSpan();
+ const SwTableBox *pTabBox = GetTabBox();
+ long nRet = pTabBox ? pTabBox->getRowSpan() : 0;
if ( nRet < 1 )
{
const SwFrame* pRow = GetUpper();
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
