basic/source/comp/loops.cxx | 5 +++++
1 file changed, 5 insertions(+)
New commits:
commit 398eaaa804961a54ef40d86bc3eee1c1f486500d
Author: Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Tue Feb 27 13:44:37 2024 +0600
Commit: Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Feb 27 12:56:06 2024 +0100
tdf#159908: return early to avoid nullptr dereference
When aLvalue is not a variable, its GetRealVar() returns nullptr.
That was dereferenced unconditionally later in the check of the
variable after NEXT.
Change-Id: Ia46f23a7e720431bf62ace998848b684aa8449e8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164002
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
(cherry picked from commit 8bbfbe92c01bff38ed2241da56560b84f7954beb)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163976
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
diff --git a/basic/source/comp/loops.cxx b/basic/source/comp/loops.cxx
index 07aac44943a6..f903f650a2bf 100644
--- a/basic/source/comp/loops.cxx
+++ b/basic/source/comp/loops.cxx
@@ -210,6 +210,11 @@ void SbiParser::For()
if( bForEach )
Next();
SbiExpression aLvalue( this, SbOPERAND );
+ if (!aLvalue.IsVariable())
+ {
+ bAbort = true;
+ return; // the error is alredy set in SbiExpression ctor
+ }
aLvalue.Gen(); // variable on the Stack
if( bForEach )
