sc/source/ui/view/viewdata.cxx |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 9cab31e8c3a497685a2695a774e06b2277623f91
Author:     Miklos Vajna <vmik...@collabora.com>
AuthorDate: Fri Jan 13 08:56:29 2023 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Thu Jan 19 15:18:18 2023 +0000

    sc: fix crash in ScViewData::GetCurXForTab()
    
    Crashreport signature:
    
    program/libsclo.so
            ScViewData::GetCurXForTab(short) const
                    sc/source/ui/view/viewdata.cxx:1431
    program/libsclo.so
            ScViewFunc::OnLOKInsertDeleteColumn(short, long)
                    sc/source/ui/view/viewfunc.cxx:1552
    program/libsclo.so
            ScDocFunc::InsertCells(ScRange const&, ScMarkData const*, 
InsCellCmd, bool, bool, bool)
                    source/ui/docshell/docfunc.cxx:2256
    program/libsclo.so
            ScViewFunc::InsertCells(InsCellCmd, bool, bool)
                    sc/source/ui/view/viewfunc.cxx:1658
    
    Seeing that e.g. ScViewData::WriteUserDataSequence() already checks if
    the pointer in maTabData is a nullptr, do the same here.
    
    Change-Id: I0ebdba8c8a5bedd3c3c57c36bdf0632e2fee45c9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145697
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    (cherry picked from commit 1f8c02353d653a6d4a72d918aaf6be5f367137c9)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145730
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sc/source/ui/view/viewdata.cxx b/sc/source/ui/view/viewdata.cxx
index 0ef96d96c7ae..ae68a5dfc725 100644
--- a/sc/source/ui/view/viewdata.cxx
+++ b/sc/source/ui/view/viewdata.cxx
@@ -1429,7 +1429,7 @@ SCROW ScViewData::GetPosY( ScVSplitPos eWhich, SCTAB 
nForTab ) const
 
 SCCOL ScViewData::GetCurXForTab( SCTAB nTabIndex ) const
 {
-    if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
+    if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())) || !maTabData[nTabIndex])
         return -1;
 
     return maTabData[nTabIndex]->nCurX;

Reply via email to