sc/source/ui/view/viewdata.cxx |   34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

New commits:
commit ce8920448c05594f37f09c7a42ae3f3c7ccb7a1e
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Thu Oct 26 12:47:21 2023 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Thu Oct 26 17:41:02 2023 +0200

    null-deref seen in ScTabView::UpdateEditView
    
     #0  0x00007f2bcc41df63 in ScViewData::GetCurYForTab 
(this=this@entry=0x3502d0b8, nTabIndex=nTabIndex@entry=6)
         at libreoffice/sc/source/ui/view/viewdata.cxx:1443
     #1  0x00007f2bcc3ebf02 in ScTabView::UpdateEditView 
(this=this@entry=0x3502d0b0) at libreoffice/sc/source/ui/view/tabview3.cxx:2185
     #2  0x00007f2bcc3ec636 in ScTabView::UpdateFormulas 
(this=this@entry=0x3502d0b0, nStartCol=nStartCol@entry=-1, 
nStartRow=nStartRow@entry=-1, nEndCol=nEndCol@entry=-1,
         nEndRow=nEndRow@entry=-1) at 
libreoffice/sc/source/ui/view/tabview3.cxx:2327
     #3  0x00007f2bcc40735c in ScTabViewShell::Notify (this=0x3502cf20, 
rBC=..., rHint=...) at libreoffice/sc/source/ui/view/tabvwsh5.cxx:216
     #4  0x00007f2bdc1885a9 in SfxBroadcaster::Broadcast 
(this=this@entry=0x31e31430, rHint=...)
         at libreoffice/svl/source/notify/SfxBroadcaster.cxx:40
     #5  0x00007f2bcc022e6d in ScDocShell::PostDataChanged 
(this=this@entry=0x31e31430) at libreoffice/sc/source/ui/docshell/docsh3.cxx:95
     #6  0x00007f2bcc0101aa in ScDocShell::SetDocumentModified 
(this=0x31e31430) at libreoffice/sc/source/ui/docshell/docsh.cxx:3015
     #7  0x00007f2bcc010df3 in ScDocShellModificator::SetDocumentModified 
(this=this@entry=0x7fff2d168da0)
         at libreoffice/sc/source/ui/docshell/docsh.cxx:3330
     #8  0x00007f2bcc040c1a in ScDocShell::MoveTable 
(this=this@entry=0x31e31430, nSrcTab=<optimized out>, nDestTab=<optimized out>, 
bCopy=bCopy@entry=false, bRecord=bRecord@entry=false)
         at libreoffice/sc/source/ui/docshell/docsh5.cxx:1010
     #9  0x00007f2bcc441a41 in ScViewFunc::MoveTable 
(this=this@entry=0x333d0fe0, nDestDocNo=nDestDocNo@entry=0, 
nDestTab=nDestTab@entry=7, bCopy=bCopy@entry=false,
         pNewTabName=pNewTabName@entry=0x7fff2d169068) at 
libreoffice/sc/source/ui/view/viewfun2.cxx:3117
     #10 0x00007f2bcc418459 in ScTabViewShell::ExecuteTable (this=0x333d0e50, 
rReq=...) at libreoffice/sc/source/ui/view/tabvwshf.cxx:593
     #11 0x00007f2bdbd3d96f in SfxDispatcher::Call_Impl 
(this=this@entry=0x33379ed0, rShell=..., rSlot=..., rReq=..., 
bRecord=<optimized out>)
         at libreoffice/sfx2/source/control/dispatch.cxx:254
     #12 0x00007f2bdbd427ee in SfxDispatcher::Execute_ 
(this=this@entry=0x33379ed0, rShell=..., rSlot=..., rReq=..., 
eCallMode=eCallMode@entry=SfxCallMode::RECORD)
         at libreoffice/sfx2/source/control/dispatch.cxx:753
     #13 0x00007f2bdbd45a33 in SfxDispatcher::Execute (this=0x33379ed0, 
nSlot=<optimized out>, nCall=nCall@entry=SfxCallMode::RECORD, 
pArgs=pArgs@entry=0x7fff2d1694a0,
         pInternalArgs=pInternalArgs@entry=0x7fff2d169460, nModi=nModi@entry=0) 
at libreoffice/sfx2/source/control/dispatch.cxx:813
     #14 0x00007f2bdbd83c0f in SfxDispatchController_Impl::dispatch 
(this=<optimized out>, aURL=..., aArgs=..., rListener=...)
    
    we have nulls in here for hidden sheets
    
    Change-Id: I8f1295e67552f3ec9306a031aaecd0838e18d98d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158502
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sc/source/ui/view/viewdata.cxx b/sc/source/ui/view/viewdata.cxx
index 511051d6f49c..332356dd794f 100644
--- a/sc/source/ui/view/viewdata.cxx
+++ b/sc/source/ui/view/viewdata.cxx
@@ -1433,7 +1433,13 @@ SCCOL ScViewData::GetCurXForTab( SCTAB nTabIndex ) const
     if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())) || !maTabData[nTabIndex])
         return -1;
 
-    return maTabData[nTabIndex]->nCurX;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::GetCurXForTab : hidden sheet = " 
<< nTabIndex);
+        return -1;
+    }
+    return pTabData->nCurX;
 }
 
 SCROW ScViewData::GetCurYForTab( SCTAB nTabIndex ) const
@@ -1441,7 +1447,13 @@ SCROW ScViewData::GetCurYForTab( SCTAB nTabIndex ) const
     if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
             return -1;
 
-    return maTabData[nTabIndex]->nCurY;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::GetCurYForTab : hidden sheet = " 
<< nTabIndex);
+        return -1;
+    }
+    return pTabData->nCurY;
 }
 
 void ScViewData::SetCurXForTab( SCCOL nNewCurX, SCTAB nTabIndex )
@@ -1449,7 +1461,14 @@ void ScViewData::SetCurXForTab( SCCOL nNewCurX, SCTAB 
nTabIndex )
     if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
             return;
 
-    maTabData[nTabIndex]->nCurX = nNewCurX;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::SetCurXForTab : hidden sheet = " 
<< nTabIndex);
+        return;
+    }
+
+    pTabData->nCurX = nNewCurX;
 }
 
 void ScViewData::SetCurYForTab( SCCOL nNewCurY, SCTAB nTabIndex )
@@ -1457,7 +1476,14 @@ void ScViewData::SetCurYForTab( SCCOL nNewCurY, SCTAB 
nTabIndex )
     if (!ValidTab(nTabIndex) || (nTabIndex >= 
static_cast<SCTAB>(maTabData.size())))
             return;
 
-    maTabData[nTabIndex]->nCurY = nNewCurY;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::SetCurYForTab : hidden sheet = " 
<< nTabIndex);
+        return;
+    }
+
+    pTabData->nCurY = nNewCurY;
 }
 
 void ScViewData::SetMaxTiledCol( SCCOL nNewMaxCol )

Reply via email to