[Libreoffice-commits] core.git: Branch 'libreoffice-7-3' - sw/source

[Miklos Vajna (via logerrit)]

 sw/source/uibase/shells/drawsh.cxx |    5 +++++
 1 file changed, 5 insertions(+)

New commits:
commit 6bbdce82dba84204f17bcd5f4588f3a903cfb91c
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Mon May 9 11:56:06 2022 +0200
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Fri May 13 16:10:16 2022 +0200

    sw: fix crash in SwDrawShell::Execute()
    
    Crashreport signature:
    
            SwDrawShell::Execute(SfxRequest&) [clone .cold]
                    include/svx/svdhdl.hxx:194
            SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, 
bool)
                    sfx2/source/control/dispatch.cxx:255
    
    which is a bit tricky to read (probably due to LTO), but what happens
    here is that the handle index is user input and we look at index up in a
    list without error handling.
    
    This is a problem since commit 7eed711a6115bf892c998cbd73a2c5b706c6f99d
    (Extended MoveShapeHandle command for Anchors as well, 2021-05-24),
    which assumed that handle indexes and the handle list can't get out of
    sync.
    
    Fix the problem similar to what commit
    48beccf52413981d3d1c525a81a2c57048abe261 (sw: fix crash in
    SwView::Execute(), 2021-09-03) did at SID_MOVE_SHAPE_HANDLE handler for
    Writer images (this one is for Draw shapes).
    
    This fix just makes sure we don't crash, there may be some deeper reason
    why the handle index is out of sync with the handle list in the first
    place.
    
    Change-Id: I8f3a25d74082984cedce09362a690f24d7236ba6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134216
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    (cherry picked from commit 3f318b314eb161d293990efa401a626ed8017c87)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134184
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/uibase/shells/drawsh.cxx 
b/sw/source/uibase/shells/drawsh.cxx
index 9dc1ad6163c6..5286c85b3830 100644
--- a/sw/source/uibase/shells/drawsh.cxx
+++ b/sw/source/uibase/shells/drawsh.cxx
@@ -212,6 +212,11 @@ void SwDrawShell::Execute(SfxRequest &rReq)
                 const sal_uLong newPosY = newPosYTwips->GetValue();
                 const Point mPoint(newPosX, newPosY);
                 const SdrHdl* handle = 
pSdrView->GetHdlList().GetHdl(handleNum);
+                if (!handle)
+                {
+                    break;
+                }
+
                 if (handle->GetKind() == SdrHdlKind::Anchor || 
handle->GetKind() == SdrHdlKind::Anchor_TR)
                 {
                     rSh.FindAnchorPos(mPoint, /*bMoveIt=*/true);