core.git: Branch 'libreoffice-7-6' - sw/source

[Caolán McNamara (via logerrit)]

 sw/source/core/access/AccessibilityCheck.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit 5857053b05a15b52ba37844fc5eb4d301aa91287
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Thu Dec 21 16:47:18 2023 +0000
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Thu Dec 21 21:44:36 2023 +0100

    crashreporting: apparent null deref in a11y check
    
    svl/source/items/itemset.cxx:801
    svl/source/items/itemset.cxx:796
    sw/source/core/access/AccessibilityCheck.cxx:1193
    sw/source/core/access/AccessibilityCheck.cxx:1184
    sw/source/core/access/AccessibilityCheck.cxx:1562
    sw/source/core/access/AccessibilityCheck.cxx:1552
    sw/source/core/txtnode/OnlineAccessibilityCheck.cxx:134
    cppu/source/uno/copy.hxx:288
    cppu/source/uno/any.cxx:72
    cppu/source/typelib/typelib.cxx:1328
    cppu/source/typelib/typelib.cxx:2169
    
    Change-Id: I91a83ffb9f1912dd9736e3d6a194f63475f63b99
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161150
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/core/access/AccessibilityCheck.cxx 
b/sw/source/core/access/AccessibilityCheck.cxx
index 0837353949da..912a397ccb4c 100644
--- a/sw/source/core/access/AccessibilityCheck.cxx
+++ b/sw/source/core/access/AccessibilityCheck.cxx
@@ -995,10 +995,12 @@ public:
             return;
 
         // Check if it's a real caption
-        const SwNode* aStartFly = pCurrent->FindFlyStartNode();
-        if (aStartFly
-            && aStartFly->GetFlyFormat()->GetAnchor().GetAnchorId() != 
RndStdIds::FLY_AS_CHAR)
-            return;
+        if (const SwNode* pStartFly = pCurrent->FindFlyStartNode())
+        {
+            const SwFrameFormat* pFormat = pStartFly->GetFlyFormat();
+            if (!pFormat || pFormat->GetAnchor().GetAnchorId() != 
RndStdIds::FLY_AS_CHAR)
+                return;
+        }
 
         auto aIter = SwIterator<SwTextFrame, SwTextNode, 
sw::IteratorMode::UnwrapMulti>(*pTextNode);
         auto nCount = 0;