sc/source/ui/inc/viewdata.hxx  |    1 +
 sc/source/ui/view/viewdata.cxx |   33 +++++++++++++++++----------------
 2 files changed, 18 insertions(+), 16 deletions(-)

New commits:
commit 396f56a2e7f6d818846c1d97d2d008b279e746e1
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Thu Oct 26 12:47:21 2023 +0100
Commit:     Tomaž Vajngerl <qui...@gmail.com>
CommitDate: Sat Oct 28 13:28:18 2023 +0200

    null-deref seen in ScTabView::UpdateEditView
    
     #0  0x00007f2bcc41df63 in ScViewData::GetCurYForTab 
(this=this@entry=0x3502d0b8, nTabIndex=nTabIndex@entry=6)
         at libreoffice/sc/source/ui/view/viewdata.cxx:1443
     #1  0x00007f2bcc3ebf02 in ScTabView::UpdateEditView 
(this=this@entry=0x3502d0b0) at libreoffice/sc/source/ui/view/tabview3.cxx:2185
     #2  0x00007f2bcc3ec636 in ScTabView::UpdateFormulas 
(this=this@entry=0x3502d0b0, nStartCol=nStartCol@entry=-1, 
nStartRow=nStartRow@entry=-1, nEndCol=nEndCol@entry=-1,
         nEndRow=nEndRow@entry=-1) at 
libreoffice/sc/source/ui/view/tabview3.cxx:2327
     #3  0x00007f2bcc40735c in ScTabViewShell::Notify (this=0x3502cf20, 
rBC=..., rHint=...) at libreoffice/sc/source/ui/view/tabvwsh5.cxx:216
     #4  0x00007f2bdc1885a9 in SfxBroadcaster::Broadcast 
(this=this@entry=0x31e31430, rHint=...)
         at libreoffice/svl/source/notify/SfxBroadcaster.cxx:40
     #5  0x00007f2bcc022e6d in ScDocShell::PostDataChanged 
(this=this@entry=0x31e31430) at libreoffice/sc/source/ui/docshell/docsh3.cxx:95
     #6  0x00007f2bcc0101aa in ScDocShell::SetDocumentModified 
(this=0x31e31430) at libreoffice/sc/source/ui/docshell/docsh.cxx:3015
     #7  0x00007f2bcc010df3 in ScDocShellModificator::SetDocumentModified 
(this=this@entry=0x7fff2d168da0)
         at libreoffice/sc/source/ui/docshell/docsh.cxx:3330
     #8  0x00007f2bcc040c1a in ScDocShell::MoveTable 
(this=this@entry=0x31e31430, nSrcTab=<optimized out>, nDestTab=<optimized out>, 
bCopy=bCopy@entry=false, bRecord=bRecord@entry=false)
         at libreoffice/sc/source/ui/docshell/docsh5.cxx:1010
     #9  0x00007f2bcc441a41 in ScViewFunc::MoveTable 
(this=this@entry=0x333d0fe0, nDestDocNo=nDestDocNo@entry=0, 
nDestTab=nDestTab@entry=7, bCopy=bCopy@entry=false,
         pNewTabName=pNewTabName@entry=0x7fff2d169068) at 
libreoffice/sc/source/ui/view/viewfun2.cxx:3117
     #10 0x00007f2bcc418459 in ScTabViewShell::ExecuteTable (this=0x333d0e50, 
rReq=...) at libreoffice/sc/source/ui/view/tabvwshf.cxx:593
     #11 0x00007f2bdbd3d96f in SfxDispatcher::Call_Impl 
(this=this@entry=0x33379ed0, rShell=..., rSlot=..., rReq=..., 
bRecord=<optimized out>)
         at libreoffice/sfx2/source/control/dispatch.cxx:254
     #12 0x00007f2bdbd427ee in SfxDispatcher::Execute_ 
(this=this@entry=0x33379ed0, rShell=..., rSlot=..., rReq=..., 
eCallMode=eCallMode@entry=SfxCallMode::RECORD)
         at libreoffice/sfx2/source/control/dispatch.cxx:753
     #13 0x00007f2bdbd45a33 in SfxDispatcher::Execute (this=0x33379ed0, 
nSlot=<optimized out>, nCall=nCall@entry=SfxCallMode::RECORD, 
pArgs=pArgs@entry=0x7fff2d1694a0,
         pInternalArgs=pInternalArgs@entry=0x7fff2d169460, nModi=nModi@entry=0) 
at libreoffice/sfx2/source/control/dispatch.cxx:813
     #14 0x00007f2bdbd83c0f in SfxDispatchController_Impl::dispatch 
(this=<optimized out>, aURL=..., aArgs=..., rListener=...)
    
    we have nulls in here for hidden sheets
    
    Change-Id: I8f1295e67552f3ec9306a031aaecd0838e18d98d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158442
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Tomaž Vajngerl <qui...@gmail.com>

diff --git a/sc/source/ui/inc/viewdata.hxx b/sc/source/ui/inc/viewdata.hxx
index 34bc8c49c4f6..abe93954f774 100644
--- a/sc/source/ui/inc/viewdata.hxx
+++ b/sc/source/ui/inc/viewdata.hxx
@@ -343,6 +343,7 @@ private:
     SAL_DLLPRIVATE void          CreateSelectedTabData();
     SAL_DLLPRIVATE void          EnsureTabDataSize(size_t nSize);
     SAL_DLLPRIVATE void          UpdateCurrentTab();
+    SAL_DLLPRIVATE ScViewDataTable* FetchTableData(SCTAB) const;
 
     ScViewData(ScDocument* pDoc, ScDocShell* pDocSh, ScTabViewShell* pViewSh);
 
diff --git a/sc/source/ui/view/viewdata.cxx b/sc/source/ui/view/viewdata.cxx
index e400f1b314ff..57ef3e5487d0 100644
--- a/sc/source/ui/view/viewdata.cxx
+++ b/sc/source/ui/view/viewdata.cxx
@@ -1427,36 +1427,37 @@ SCROW ScViewData::GetPosY( ScVSplitPos eWhich, SCTAB 
nForTab ) const
     return maTabData[nForTab]->nPosY[eWhich];
 }
 
-SCCOL ScViewData::GetCurXForTab( SCTAB nTabIndex ) const
+ScViewDataTable* ScViewData::FetchTableData(SCTAB nTabIndex) const
 {
-    if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())) || !maTabData[nTabIndex])
-        return -1;
+    if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
+        return nullptr;
+    ScViewDataTable* pRet = maTabData[nTabIndex].get();
+    SAL_WARN_IF(!pRet, "sc.viewdata", "ScViewData::FetchTableData: hidden 
sheet = " << nTabIndex);
+    return pRet;
+}
 
-    return maTabData[nTabIndex]->nCurX;
+SCCOL ScViewData::GetCurXForTab( SCTAB nTabIndex ) const
+{
+    ScViewDataTable* pTabData = FetchTableData(nTabIndex);
+    return pTabData ? pTabData->nCurX : -1;
 }
 
 SCROW ScViewData::GetCurYForTab( SCTAB nTabIndex ) const
 {
-    if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
-            return -1;
-
-    return maTabData[nTabIndex]->nCurY;
+    ScViewDataTable* pTabData = FetchTableData(nTabIndex);
+    return pTabData ? pTabData->nCurY : -1;
 }
 
 void ScViewData::SetCurXForTab( SCCOL nNewCurX, SCTAB nTabIndex )
 {
-    if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
-            return;
-
-    maTabData[nTabIndex]->nCurX = nNewCurX;
+    if (ScViewDataTable* pTabData = FetchTableData(nTabIndex))
+        pTabData->nCurX = nNewCurX;
 }
 
 void ScViewData::SetCurYForTab( SCCOL nNewCurY, SCTAB nTabIndex )
 {
-    if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
-            return;
-
-    maTabData[nTabIndex]->nCurY = nNewCurY;
+    if (ScViewDataTable* pTabData = FetchTableData(nTabIndex))
+        pTabData->nCurY = nNewCurY;
 }
 
 void ScViewData::SetMaxTiledCol( SCCOL nNewMaxCol )

Reply via email to