core.git: Branch 'distro/collabora/co-23.05' - sw/source

[Caolán McNamara (via logerrit)]

 sw/source/core/access/AccessibilityCheck.cxx |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

New commits:
commit 117658b28d3c64cd94747547e118764ef495d959
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Thu Dec 21 16:47:18 2023 +0000
Commit:     Tomaž Vajngerl <qui...@gmail.com>
CommitDate: Wed Dec 27 08:03:47 2023 +0100

    crashreporting: apparent null deref in a11y check
    
    svl/source/items/itemset.cxx:801
    svl/source/items/itemset.cxx:796
    sw/source/core/access/AccessibilityCheck.cxx:1193
    sw/source/core/access/AccessibilityCheck.cxx:1184
    sw/source/core/access/AccessibilityCheck.cxx:1562
    sw/source/core/access/AccessibilityCheck.cxx:1552
    sw/source/core/txtnode/OnlineAccessibilityCheck.cxx:134
    cppu/source/uno/copy.hxx:288
    cppu/source/uno/any.cxx:72
    cppu/source/typelib/typelib.cxx:1328
    cppu/source/typelib/typelib.cxx:2169
    
    Change-Id: I91a83ffb9f1912dd9736e3d6a194f63475f63b99
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161151
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Tomaž Vajngerl <qui...@gmail.com>

diff --git a/sw/source/core/access/AccessibilityCheck.cxx 
b/sw/source/core/access/AccessibilityCheck.cxx
index 2121ed10519b..c8577a4fc036 100644
--- a/sw/source/core/access/AccessibilityCheck.cxx
+++ b/sw/source/core/access/AccessibilityCheck.cxx
@@ -931,10 +931,12 @@ public:
             return;
 
         // Check if it's a real caption
-        const SwNode* aStartFly = pCurrent->FindFlyStartNode();
-        if (aStartFly
-            && aStartFly->GetFlyFormat()->GetAnchor().GetAnchorId() != 
RndStdIds::FLY_AS_CHAR)
-            return;
+        if (const SwNode* pStartFly = pCurrent->FindFlyStartNode())
+        {
+            const SwFrameFormat* pFormat = pStartFly->GetFlyFormat();
+            if (!pFormat || pFormat->GetAnchor().GetAnchorId() != 
RndStdIds::FLY_AS_CHAR)
+                return;
+        }
 
         auto aIter = SwIterator<SwTextFrame, SwTextNode, 
sw::IteratorMode::UnwrapMulti>(*pTextNode);
         auto nCount = 0;