[Libreoffice-commits] core.git: Branch 'distro/collabora/co-22.05' - sw/source

[Miklos Vajna (via logerrit)]

 sw/source/uibase/shells/drawsh.cxx |    5 +++++
 1 file changed, 5 insertions(+)

New commits:
commit f440e1ab725c14c6acac4f7275ca9d9192c6af2a
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Mon May 9 11:56:06 2022 +0200
Commit:     Miklos Vajna <vmik...@collabora.com>
CommitDate: Wed May 11 14:54:47 2022 +0200

    sw: fix crash in SwDrawShell::Execute()
    
    Crashreport signature:
    
            SwDrawShell::Execute(SfxRequest&) [clone .cold]
                    include/svx/svdhdl.hxx:194
            SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, 
bool)
                    sfx2/source/control/dispatch.cxx:255
    
    which is a bit tricky to read (probably due to LTO), but what happens
    here is that the handle index is user input and we look at index up in a
    list without error handling.
    
    This is a problem since commit 7eed711a6115bf892c998cbd73a2c5b706c6f99d
    (Extended MoveShapeHandle command for Anchors as well, 2021-05-24),
    which assumed that handle indexes and the handle list can't get out of
    sync.
    
    Fix the problem similar to what commit
    48beccf52413981d3d1c525a81a2c57048abe261 (sw: fix crash in
    SwView::Execute(), 2021-09-03) did at SID_MOVE_SHAPE_HANDLE handler for
    Writer images (this one is for Draw shapes).
    
    This fix just makes sure we don't crash, there may be some deeper reason
    why the handle index is out of sync with the handle list in the first
    place.
    
    Change-Id: I8f3a25d74082984cedce09362a690f24d7236ba6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134144
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>

diff --git a/sw/source/uibase/shells/drawsh.cxx 
b/sw/source/uibase/shells/drawsh.cxx
index 9dc1ad6163c6..5286c85b3830 100644
--- a/sw/source/uibase/shells/drawsh.cxx
+++ b/sw/source/uibase/shells/drawsh.cxx
@@ -212,6 +212,11 @@ void SwDrawShell::Execute(SfxRequest &rReq)
                 const sal_uLong newPosY = newPosYTwips->GetValue();
                 const Point mPoint(newPosX, newPosY);
                 const SdrHdl* handle = 
pSdrView->GetHdlList().GetHdl(handleNum);
+                if (!handle)
+                {
+                    break;
+                }
+
                 if (handle->GetKind() == SdrHdlKind::Anchor || 
handle->GetKind() == SdrHdlKind::Anchor_TR)
                 {
                     rSh.FindAnchorPos(mPoint, /*bMoveIt=*/true);