core.git: Branch 'libreoffice-24-2' - sw/source

[Caolán McNamara (via logerrit)]

 sw/source/core/access/AccessibilityCheck.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit 274380def4cdbf4cec86951c3a539b88043aa048
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Thu Dec 21 16:47:18 2023 +0000
Commit:     Adolfo Jayme Barrientos <fit...@ubuntu.com>
CommitDate: Thu Dec 21 23:30:15 2023 +0100

    crashreporting: apparent null deref in a11y check
    
    svl/source/items/itemset.cxx:801
    svl/source/items/itemset.cxx:796
    sw/source/core/access/AccessibilityCheck.cxx:1193
    sw/source/core/access/AccessibilityCheck.cxx:1184
    sw/source/core/access/AccessibilityCheck.cxx:1562
    sw/source/core/access/AccessibilityCheck.cxx:1552
    sw/source/core/txtnode/OnlineAccessibilityCheck.cxx:134
    cppu/source/uno/copy.hxx:288
    cppu/source/uno/any.cxx:72
    cppu/source/typelib/typelib.cxx:1328
    cppu/source/typelib/typelib.cxx:2169
    
    Change-Id: I91a83ffb9f1912dd9736e3d6a194f63475f63b99
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161109
    Tested-by: Jenkins
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>

diff --git a/sw/source/core/access/AccessibilityCheck.cxx 
b/sw/source/core/access/AccessibilityCheck.cxx
index 2e3219765e22..36226b028937 100644
--- a/sw/source/core/access/AccessibilityCheck.cxx
+++ b/sw/source/core/access/AccessibilityCheck.cxx
@@ -1029,10 +1029,12 @@ public:
             return;
 
         // Check if it's a real caption
-        const SwNode* aStartFly = pCurrent->FindFlyStartNode();
-        if (aStartFly
-            && aStartFly->GetFlyFormat()->GetAnchor().GetAnchorId() != 
RndStdIds::FLY_AS_CHAR)
-            return;
+        if (const SwNode* pStartFly = pCurrent->FindFlyStartNode())
+        {
+            const SwFrameFormat* pFormat = pStartFly->GetFlyFormat();
+            if (!pFormat || pFormat->GetAnchor().GetAnchorId() != 
RndStdIds::FLY_AS_CHAR)
+                return;
+        }
 
         auto aIter = SwIterator<SwTextFrame, SwTextNode, 
sw::IteratorMode::UnwrapMulti>(*pTextNode);
         auto nCount = 0;