https://bugs.documentfoundation.org/show_bug.cgi?id=99556
Bug ID: 99556
Summary: CRASH: NULL pointer dereference in MathML node.cxx
Product: LibreOffice
Version: 5.2.0.0.alpha1
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: framework
Assignee: libreoffice-bugs@lists.freedesktop.org
Reporter: s.zelen...@yandex.ru
Abstract: MathML msqrt element will be handled improperly when it has no
children.
Problem: there is no code to check whether a node has a subnodes or not in
SmRootNode::CreateTextFromNode function:
// ...
if (!pExtra && GetSubNode(2)->GetNumSubNodes() > 1)
rText += "{ ";
GetSubNode(2)->CreateTextFromNode(rText);
if (!pExtra && GetSubNode(2)->GetNumSubNodes() > 1)
rText += "} ";
// ...
In the case of <msqrt/> (see below) a return value of GetSubNode will be NULL
so it cannot be dereferenced.
Solution: store a return values of GetSubNode and compare them with NULL before
dereferencing.
How to reproduce: copy the code below into example.xml and open it in
LibreOffice.
<math xmlns="http://www.w3.org/1998/Math/MathML";>
<msqrt/>
</math>
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
Libreoffice-bugs mailing list
Libreoffice-bugs@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
