[Libreoffice-commits] core.git: Branch 'distro/collabora/co-2021' - sw/source

[Miklos Vajna (via logerrit)]

 sw/source/uibase/shells/drawsh.cxx |    5 +++++
 1 file changed, 5 insertions(+)

New commits:
commit 085ce02849fe8e56d09afefee8a3e718aa3fac30
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Mon May 9 11:56:06 2022 +0200
Commit:     Miklos Vajna <vmik...@collabora.com>
CommitDate: Tue May 10 11:37:35 2022 +0200

    sw: fix crash in SwDrawShell::Execute()
    
    Crashreport signature:
    
            SwDrawShell::Execute(SfxRequest&) [clone .cold]
                    include/svx/svdhdl.hxx:194
            SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, 
bool)
                    sfx2/source/control/dispatch.cxx:255
    
    which is a bit tricky to read (probably due to LTO), but what happens
    here is that the handle index is user input and we look at index up in a
    list without error handling.
    
    This is a problem since commit 7eed711a6115bf892c998cbd73a2c5b706c6f99d
    (Extended MoveShapeHandle command for Anchors as well, 2021-05-24),
    which assumed that handle indexes and the handle list can't get out of
    sync.
    
    Fix the problem similar to what commit
    48beccf52413981d3d1c525a81a2c57048abe261 (sw: fix crash in
    SwView::Execute(), 2021-09-03) did at SID_MOVE_SHAPE_HANDLE handler for
    Writer images (this one is for Draw shapes).
    
    This fix just makes sure we don't crash, there may be some deeper reason
    why the handle index is out of sync with the handle list in the first
    place.
    
    Change-Id: I8f3a25d74082984cedce09362a690f24d7236ba6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134046
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>

diff --git a/sw/source/uibase/shells/drawsh.cxx 
b/sw/source/uibase/shells/drawsh.cxx
index cf90304da675..1daf921e6ed8 100644
--- a/sw/source/uibase/shells/drawsh.cxx
+++ b/sw/source/uibase/shells/drawsh.cxx
@@ -215,6 +215,11 @@ void SwDrawShell::Execute(SfxRequest &rReq)
                 const sal_uLong newPosY = newPosYTwips->GetValue();
                 const Point mPoint(newPosX, newPosY);
                 const SdrHdl* handle = 
pSdrView->GetHdlList().GetHdl(handleNum);
+                if (!handle)
+                {
+                    break;
+                }
+
                 if (handle->GetKind() == SdrHdlKind::Anchor || 
handle->GetKind() == SdrHdlKind::Anchor_TR)
                 {
                     rSh.FindAnchorPos(mPoint, /*bMoveIt=*/true);