sw/source/core/layout/frmtool.cxx |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 4d48d43a68b5cdda15092d0ae9b25d48bce6d1de
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Aug 11 09:58:55 2025 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Mon Aug 11 21:41:00 2025 +0200

    null deref of pActualSection seen
    
     #0  0x00007b8ff1659933 in std::__uniq_ptr_impl<SwActualSection, 
std::default_delete<SwActualSection> >::reset (
         __p=<error reading variable: Cannot access memory at address 0x0>, 
this=0x7fff18bf8ff8)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/unique_ptr.h:201
     #1  std::unique_ptr<SwActualSection, std::default_delete<SwActualSection> 
>::reset (
         __p=<error reading variable: Cannot access memory at address 0x0>, 
this=0x7fff18bf8ff8)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/unique_ptr.h:501
     #2  InsertCnt_ (pLay=<optimized out>, pLay@entry=0x5fad9100, 
pDoc=pDoc@entry=0x5e955800, nIndex=..., bPages=bPages@entry=false,
         nEndIndex=..., nEndIndex@entry=..., pPrv=<optimized out>, 
eMode=<optimized out>)
         at sw/source/core/layout/frmtool.cxx:1915
     #3  0x00007b8ff165ac01 in MakeFrames (pDoc=pDoc@entry=0x5e955800, 
rSttIdx=..., rEndIdx=...)
         at sw/source/core/layout/frmtool.cxx:2211
     #4  0x00007b8ff1862f31 in SwUndoDelete::UndoImpl (this=<optimized out>, 
rContext=...)
         at sw/source/core/undo/undel.cxx:1184
     #5  0x00007b8ff18645aa in SwUndo::UndoWithContext (this=0x62c9c1e0, 
rContext=...)
         at sw/source/core/undo/undobj.cxx:225
     #6  0x00007b8ffecc6f91 in SfxUndoManager::ImplUndo (this=0x5ea06758, 
i_contextOrNull=0x7fff18bf9580)
         at svl/source/undo/undo.cxx:732
     #7  0x00007b8ffecc7489 in SfxUndoManager::UndoWithContext (this=<optimized 
out>, i_context=...)
         at svl/source/undo/undo.cxx:682
     #8  0x00007b8ff184ddd8 in sw::UndoManager::impl_DoUndoRedo 
(this=0x5ea06750, undoOrRedo=sw::UndoManager::UndoOrRedoType::Undo,
         nUndoOffset=<optimized out>) at sw/source/core/undo/docundo.cxx:700
     #9  0x00007b8ff1591a3b in SwEditShell::Undo (this=this@entry=0x5eaf4900, 
nCount=nCount@entry=40, nOffset=nOffset@entry=0)
         at sw/source/core/edit/edundo.cxx:143
     #10 0x00007b8ff1f58262 in SwWrtShell::Do (this=this@entry=0x5eaf4900, 
eDoType=eDoType@entry=SwWrtShell::UNDO,
         nCnt=nCnt@entry=40, nOffset=<optimized out>) at 
sw/source/uibase/wrtsh/wrtundo.cxx:45
     #11 0x00007b8ff1d4934a in SwBaseShell::ExecUndo (this=<optimized out>, 
rReq=...)
         at sw/source/uibase/shells/basesh.cxx:669
     #12 0x00007b8ffe7fb3ef in SfxDispatcher::Call_Impl (this=0x5e9cb020, 
rShell=..., rSlot=..., rReq=..., bRecord=<optimized out>)
        at sfx2/source/control/dispatch.cxx:255
     #13 0x00007b8ffe802af7 in SfxDispatcher::Execute (this=0x5e9cb020, 
nSlot=<optimized out>,
         nCall=nCall@entry=SfxCallMode::SYNCHRON, 
pArgs=pArgs@entry=0x7fff18bf9ca0, 
pInternalArgs=pInternalArgs@entry=0x7fff18bf9c30,
         nModi=0) at sfx2/source/control/dispatch.cxx:813
    
    Change-Id: I3e3bd43f853521163581a7e2d575c1ebe7dc2bfb
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189352
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sw/source/core/layout/frmtool.cxx 
b/sw/source/core/layout/frmtool.cxx
index 96057604c12f..f5b4d4c5f3eb 100644
--- a/sw/source/core/layout/frmtool.cxx
+++ b/sw/source/core/layout/frmtool.cxx
@@ -1913,11 +1913,14 @@ void InsertCnt_( SwLayoutFrame *pLay, SwDoc& rDoc,
                 continue; // skip it
             }
             assert(pActualSection && "Section end without section start?");
-            assert(pActualSection->GetSectionNode() == 
pNd->StartOfSectionNode());
 
             //Close the section, where appropriate activate the surrounding
             //section again.
-            pActualSection.reset(pActualSection->GetUpper());
+            if (pActualSection)
+            {
+                assert(pActualSection->GetSectionNode() == 
pNd->StartOfSectionNode());
+                pActualSection.reset(pActualSection->GetUpper());
+            }
             pLay = pLay->FindSctFrame();
             if ( pActualSection )
             {

Reply via email to