writerfilter: fix crash in DomainMapper_Impl::PushSdt()

Crashreport signature:

Fatal signal received: SIGSEGV code: 1 for address: 0x0

program/libwriterfilterlo.so
        writerfilter::dmapper::DomainMapper_Impl::PushSdt()
                writerfilter/source/dmapper/DomainMapper_Impl.cxx:987
program/libwriterfilterlo.so
        writerfilter::dmapper::DomainMapper::lcl_attribute(unsigned int, writerfilter::Value&)
                include/tools/ref.hxx:56
program/libwriterfilterlo.so
        writerfilter::ooxml::OOXMLProperty::resolve(writerfilter::Properties&)
                include/tools/ref.hxx:56
program/libwriterfilterlo.so
        writerfilter::ooxml::OOXMLPropertySet::resolve(writerfilter::Properties&)
                include/tools/ref.hxx:157

Change-Id: I76416ca707a4ac40495e5c22f62fcd017bcb5e48
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/160336
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Tested-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit 728f6ec104b1a91c8c8ea0790bc7f56471c67737)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/160351
Tested-by: Jenkins

1 files changed, 12 insertions, 1 deletions

diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 183d71d5833a..e9d57ea34cef 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -977,8 +977,19 @@ void DomainMapper_Impl::PushSdt()
     }
 
     uno::Reference<text::XTextAppend> xTextAppend = m_aTextAppendStack.top().xTextAppend;
+    if (!xTextAppend.is())
+    {
+        return;
+    }
+
+    uno::Reference<text::XText> xText = xTextAppend->getText();
+    if (!xText.is())
+    {
+        return;
+    }
+
     uno::Reference<text::XTextCursor> xCursor
-        = xTextAppend->getText()->createTextCursorByRange(xTextAppend->getEnd());
+        = xText->createTextCursorByRange(xTextAppend->getEnd());
     // Offset so the cursor is not adjusted as we import the SDT's content.
     bool bStart = !xCursor->goLeft(1, /*bExpand=*/false);
     m_xSdtStarts.push({bStart, OUString(), xCursor->getStart()});