Null deref in ScDocument::IsClipboardSource

Appears to be a regression introduced with
b6b1ded0a0539e7be1b5338de378a3276a6ff445 "sc: replace ScCaptionPtr with
std::shared_ptr, tdf#117997, tdf#117228".  Reported e.g. as
<https://ci.libreoffice.org//job/lo_ubsan/954/console> during
CppunitTest_sc_subsequent_export_test and CppunitTest_sc_ucalc:

> /sc/source/core/data/document.cxx:2574:28: runtime error: member call on null pointer of type 'ScDocShell'
>     #0 0x2b9971542d76 in ScDocument::IsClipboardSource() const /sc/source/core/data/document.cxx:2574:28
>     #1 0x2b99722b7762 in ScFormulaCell::ScFormulaCell(ScFormulaCell const&, ScDocument&, ScAddress const&, ScCloneFlags) /sc/source/core/data/formulacell.cxx:844:14
>     #2 0x2b996fee35b0 in ScCellValue::assign(ScCellValue const&, ScDocument&, ScCloneFlags) /sc/source/core/data/cellvalue.cxx:395:29
>     #3 0x2b997312db22 in ScChangeTrack::Clone(ScDocument*) const /sc/source/core/tool/chgtrack.cxx:4565:25
>     #4 0x2b99cd1728be in XclExpChangeTrack::CreateTempChangeTrack() /sc/source/filter/xcl97/XclExpChangeTrack.cxx:1561:12
>     #5 0x2b99cd169a74 in XclExpChangeTrack::XclExpChangeTrack(XclExpRoot const&) /sc/source/filter/xcl97/XclExpChangeTrack.cxx:1418:39
>     #6 0x2b99cab087c0 in ExcDocument::ReadDoc() /sc/source/filter/excel/excdoc.cxx:788:41
>     #7 0x2b99cadddc2e in ExportBiff5::Write() /sc/source/filter/excel/expop2.cxx:112:5
>     #8 0x2b99cab8ee83 in lcl_ExportExcelBiff(SfxMedium&, ScDocument*, SvStream*, bool, unsigned short) /sc/source/filter/excel/excel.cxx:181:16
>     #9 0x2b99cab8d342 in ScFormatFilterPluginImpl::ScExportExcel5(SfxMedium&, ScDocument*, ExportFormatExcel, unsigned short) /sc/source/filter/excel/excel.cxx:219:16
>     #10 0x2b99768df9d2 in ScDocShell::ConvertTo(SfxMedium&) /sc/source/ui/docshell/docsh.cxx:2419:30
>     #11 0x2b998a7e2550 in SfxObjectShell::SaveTo_Impl(SfxMedium&, SfxItemSet const*) /sfx2/source/doc/objstor.cxx:1513:19
>     #12 0x2b998a7fe5e2 in SfxObjectShell::DoSaveAs(SfxMedium&) /sfx2/source/doc/objstor.cxx:1900:17
>     #13 0x2b9985a31bb6 in ScBootstrapFixture::saveAndReload(ScDocShell*, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags) /sc/qa/unit/helper/qahelper.cxx:664:5
>     #14 0x2b9985a34593 in ScBootstrapFixture::saveAndReload(ScDocShell*, int) /sc/qa/unit/helper/qahelper.cxx:686:28
>     #15 0x2b9956fca835 in ScExportTest::testTrackChangesSimpleXLSX() /sc/qa/unit/subsequent_export-test.cxx:2618:29
>     #16 0x2b9957203058 in void std::_Mem_fn_base<void (ScExportTest::*)(), true>::operator()<, void>(ScExportTest*) const /home/tdf/lode/opt_private/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/../../../../include/c++/5.2.0/functional:600:11
>     #17 0x2b9957202d63 in void std::_Bind<std::_Mem_fn<void (ScExportTest::*)()> (ScExportTest*)>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /home/tdf/lode/opt_private/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/../../../../include/c++/5.2.0/functional:1073:11
>     #18 0x2b9957202771 in void std::_Bind<std::_Mem_fn<void (ScExportTest::*)()> (ScExportTest*)>::operator()<, void>() /home/tdf/lode/opt_private/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/../../../../include/c++/5.2.0/functional:1131:11
>     #19 0x2b9957201149 in std::_Function_handler<void (), std::_Bind<std::_Mem_fn<void (ScExportTest::*)()> (ScExportTest*)> >::_M_invoke(std::_Any_data const&) /home/tdf/lode/opt_private/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/../../../../include/c++/5.2.0/functional:1871:2
>     #20 0x2b9957203ad0 in std::function<void ()>::operator()() const /home/tdf/lode/opt_private/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/../../../../include/c++/5.2.0/functional:2271:14
>     #21 0x2b99571ff885 in CppUnit::TestCaller<ScExportTest>::runTest() /workdir/UnpackedTarball/cppunit/include/cppunit/TestCaller.h:175:7
>     #22 0x2b990c338e7d in CppUnit::TestCaseMethodFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/TestCase.cpp:32:5
>     #23 0x2b99294cb4d6 in (anonymous namespace)::Protector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /test/source/vclbootstrapprotector.cxx:48:14
>     #24 0x2b990c2f7947 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #25 0x2b991bcad7a6 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /unotest/source/cpp/unobootstrapprotector/unobootstrapprotector.cxx:89:12
>     #26 0x2b990c2f7947 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #27 0x2b9917d39e13 in (anonymous namespace)::Prot::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /unotest/source/cpp/unoexceptionprotector/unoexceptionprotector.cxx:63:16
>     #28 0x2b990c2f7947 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #29 0x2b990c2732df in CppUnit::DefaultProtector::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /workdir/UnpackedTarball/cppunit/src/cppunit/DefaultProtector.cpp:15:12
>     #30 0x2b990c2f7947 in CppUnit::ProtectorChain::ProtectFunctor::operator()() const /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:20:12
>     #31 0x2b990c2edb70 in CppUnit::ProtectorChain::protect(CppUnit::Functor const&, CppUnit::ProtectorContext const&) /workdir/UnpackedTarball/cppunit/src/cppunit/ProtectorChain.cpp:86:18
>     #32 0x2b990c3c2ccb in CppUnit::TestResult::protect(CppUnit::Functor const&, CppUnit::Test*, std::string const&) /workdir/UnpackedTarball/cppunit/src/cppunit/TestResult.cpp:182:10
>     #33 0x2b990c335efd in CppUnit::TestCase::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestCase.cpp:91:5
>     #34 0x2b990c33c0b3 in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:64:5
>     #35 0x2b990c33b01d in CppUnit::TestComposite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:23:3
>     #36 0x2b990c33c0b3 in CppUnit::TestComposite::doRunChildTests(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:64:5
>     #37 0x2b990c33b01d in CppUnit::TestComposite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestComposite.cpp:23:3
>     #38 0x2b990c402686 in CppUnit::TestRunner::WrappingSuite::run(CppUnit::TestResult*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestRunner.cpp:47:5
>     #39 0x2b990c3c0e19 in CppUnit::TestResult::runTest(CppUnit::Test*) /workdir/UnpackedTarball/cppunit/src/cppunit/TestResult.cpp:149:3
>     #40 0x2b990c403b27 in CppUnit::TestRunner::run(CppUnit::TestResult&, std::string const&) /workdir/UnpackedTarball/cppunit/src/cppunit/TestRunner.cpp:96:3
>     #41 0x515d6d in (anonymous namespace)::ProtectedFixtureFunctor::run() const /sal/cppunittester/cppunittester.cxx:315:13
>     #42 0x51071f in sal_main() /sal/cppunittester/cppunittester.cxx:465:14
>     #43 0x50e832 in main /sal/cppunittester/cppunittester.cxx:372:1
>     #44 0x2b990e038444 in __libc_start_main (/lib64/libc.so.6+0x22444)
>     #45 0x433494 in _start (/workdir/LinkTarget/Executable/cppunittester+0x433494)

Change-Id: Id6cbc92844c89d48daecf8fad0b8899fcd087eaa
Reviewed-on: https://gerrit.libreoffice.org/56513
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Reviewed-on: https://gerrit.libreoffice.org/59629
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Andras Timar <andras.timar@collabora.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/sc/source/core/data/document.cxx b/sc/source/core/data/document.cxx
index 387b98cc6ec2..1c06c813c2f7 100644
--- a/sc/source/core/data/document.cxx
+++ b/sc/source/core/data/document.cxx
@@ -2586,7 +2586,7 @@ void ScDocument::SetClipParam(const ScClipParam& rParam)
 
 bool ScDocument::IsClipboardSource() const
 {
-    if (bIsClip)
+    if (bIsClip || mpShell == nullptr)
         return false;
 
     ScDocument* pClipDoc = static_cast<ScDocShell*>(mpShell)->GetClipDoc();