diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2020-06-13 15:55:33 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2020-06-13 18:13:22 +0200 |
| commit | 058fdc75afa9e5e69c6e11ab7879ddb9d51ae1c5 (patch) | |
| tree | 54c29e77865ac68ae009f010272cd777a62f107e | |
| parent | 9debed4ca680706da74824f7d46198ac0e422f80 (diff) | |
crashtesting: null deref in SwCellFrame::GetLayoutRowSpan
seen with swtextframe_connectfootnote_heap_use_after_free.sample
Change-Id: I98da2e67065c5890d74e5f33ffc01329ff75f185
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96257
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | sw/source/core/layout/tabfrm.cxx | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx index 0a3e5f997357..2642c5018f1d 100644 --- a/sw/source/core/layout/tabfrm.cxx +++ b/sw/source/core/layout/tabfrm.cxx @@ -5366,7 +5366,8 @@ void SwCellFrame::Modify( const SfxPoolItem* pOld, const SfxPoolItem * pNew ) long SwCellFrame::GetLayoutRowSpan() const { - long nRet = GetTabBox()->getRowSpan(); + const SwTableBox *pTabBox = GetTabBox(); + long nRet = pTabBox ? pTabBox->getRowSpan() : 0; if ( nRet < 1 ) { const SwFrame* pRow = GetUpper(); |