summaryrefslogtreecommitdiff
path: root/sw/source/core/layout/tabfrm.cxx
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2020-06-13 15:55:33 +0100
committerCaolán McNamara <caolanm@redhat.com>2020-06-13 18:13:22 +0200
commit058fdc75afa9e5e69c6e11ab7879ddb9d51ae1c5 (patch)
tree54c29e77865ac68ae009f010272cd777a62f107e /sw/source/core/layout/tabfrm.cxx
parent9debed4ca680706da74824f7d46198ac0e422f80 (diff)
crashtesting: null deref in SwCellFrame::GetLayoutRowSpan
seen with swtextframe_connectfootnote_heap_use_after_free.sample Change-Id: I98da2e67065c5890d74e5f33ffc01329ff75f185 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96257 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'sw/source/core/layout/tabfrm.cxx')
-rw-r--r--sw/source/core/layout/tabfrm.cxx3
1 files changed, 2 insertions, 1 deletions
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 0a3e5f997357..2642c5018f1d 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -5366,7 +5366,8 @@ void SwCellFrame::Modify( const SfxPoolItem* pOld, const SfxPoolItem * pNew )
long SwCellFrame::GetLayoutRowSpan() const
{
- long nRet = GetTabBox()->getRowSpan();
+ const SwTableBox *pTabBox = GetTabBox();
+ long nRet = pTabBox ? pTabBox->getRowSpan() : 0;
if ( nRet < 1 )
{
const SwFrame* pRow = GetUpper();