sw/source/uibase/shells/drawsh.cxx | 5 +++++ 1 file changed, 5 insertions(+)
New commits: commit f440e1ab725c14c6acac4f7275ca9d9192c6af2a Author: Miklos Vajna <vmik...@collabora.com> AuthorDate: Mon May 9 11:56:06 2022 +0200 Commit: Miklos Vajna <vmik...@collabora.com> CommitDate: Wed May 11 14:54:47 2022 +0200 sw: fix crash in SwDrawShell::Execute() Crashreport signature: SwDrawShell::Execute(SfxRequest&) [clone .cold] include/svx/svdhdl.hxx:194 SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) sfx2/source/control/dispatch.cxx:255 which is a bit tricky to read (probably due to LTO), but what happens here is that the handle index is user input and we look at index up in a list without error handling. This is a problem since commit 7eed711a6115bf892c998cbd73a2c5b706c6f99d (Extended MoveShapeHandle command for Anchors as well, 2021-05-24), which assumed that handle indexes and the handle list can't get out of sync. Fix the problem similar to what commit 48beccf52413981d3d1c525a81a2c57048abe261 (sw: fix crash in SwView::Execute(), 2021-09-03) did at SID_MOVE_SHAPE_HANDLE handler for Writer images (this one is for Draw shapes). This fix just makes sure we don't crash, there may be some deeper reason why the handle index is out of sync with the handle list in the first place. Change-Id: I8f3a25d74082984cedce09362a690f24d7236ba6 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134144 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com> Reviewed-by: Miklos Vajna <vmik...@collabora.com> diff --git a/sw/source/uibase/shells/drawsh.cxx b/sw/source/uibase/shells/drawsh.cxx index 9dc1ad6163c6..5286c85b3830 100644 --- a/sw/source/uibase/shells/drawsh.cxx +++ b/sw/source/uibase/shells/drawsh.cxx @@ -212,6 +212,11 @@ void SwDrawShell::Execute(SfxRequest &rReq) const sal_uLong newPosY = newPosYTwips->GetValue(); const Point mPoint(newPosX, newPosY); const SdrHdl* handle = pSdrView->GetHdlList().GetHdl(handleNum); + if (!handle) + { + break; + } + if (handle->GetKind() == SdrHdlKind::Anchor || handle->GetKind() == SdrHdlKind::Anchor_TR) { rSh.FindAnchorPos(mPoint, /*bMoveIt=*/true);