sw/source/core/layout/frmtool.cxx |    7 +++++--
 sw/source/uibase/dbui/dbmgr.cxx   |    4 +++-
 2 files changed, 8 insertions(+), 3 deletions(-)

New commits:
commit a7e08e09046694246dd05f6d22c55a59ba49b379
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Aug 11 09:58:55 2025 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Wed Aug 13 09:35:21 2025 +0200

    null deref of pActualSection seen
    
     #0  0x00007b8ff1659933 in std::__uniq_ptr_impl<SwActualSection, 
std::default_delete<SwActualSection> >::reset (
         __p=<error reading variable: Cannot access memory at address 0x0>, 
this=0x7fff18bf8ff8)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/unique_ptr.h:201
     #1  std::unique_ptr<SwActualSection, std::default_delete<SwActualSection> 
>::reset (
         __p=<error reading variable: Cannot access memory at address 0x0>, 
this=0x7fff18bf8ff8)
         at /opt/rh/devtoolset-12/root/usr/include/c++/12/bits/unique_ptr.h:501
     #2  InsertCnt_ (pLay=<optimized out>, pLay@entry=0x5fad9100, 
pDoc=pDoc@entry=0x5e955800, nIndex=..., bPages=bPages@entry=false,
         nEndIndex=..., nEndIndex@entry=..., pPrv=<optimized out>, 
eMode=<optimized out>)
         at sw/source/core/layout/frmtool.cxx:1915
     #3  0x00007b8ff165ac01 in MakeFrames (pDoc=pDoc@entry=0x5e955800, 
rSttIdx=..., rEndIdx=...)
         at sw/source/core/layout/frmtool.cxx:2211
     #4  0x00007b8ff1862f31 in SwUndoDelete::UndoImpl (this=<optimized out>, 
rContext=...)
         at sw/source/core/undo/undel.cxx:1184
     #5  0x00007b8ff18645aa in SwUndo::UndoWithContext (this=0x62c9c1e0, 
rContext=...)
         at sw/source/core/undo/undobj.cxx:225
     #6  0x00007b8ffecc6f91 in SfxUndoManager::ImplUndo (this=0x5ea06758, 
i_contextOrNull=0x7fff18bf9580)
         at svl/source/undo/undo.cxx:732
     #7  0x00007b8ffecc7489 in SfxUndoManager::UndoWithContext (this=<optimized 
out>, i_context=...)
         at svl/source/undo/undo.cxx:682
     #8  0x00007b8ff184ddd8 in sw::UndoManager::impl_DoUndoRedo 
(this=0x5ea06750, undoOrRedo=sw::UndoManager::UndoOrRedoType::Undo,
         nUndoOffset=<optimized out>) at sw/source/core/undo/docundo.cxx:700
     #9  0x00007b8ff1591a3b in SwEditShell::Undo (this=this@entry=0x5eaf4900, 
nCount=nCount@entry=40, nOffset=nOffset@entry=0)
         at sw/source/core/edit/edundo.cxx:143
     #10 0x00007b8ff1f58262 in SwWrtShell::Do (this=this@entry=0x5eaf4900, 
eDoType=eDoType@entry=SwWrtShell::UNDO,
         nCnt=nCnt@entry=40, nOffset=<optimized out>) at 
sw/source/uibase/wrtsh/wrtundo.cxx:45
     #11 0x00007b8ff1d4934a in SwBaseShell::ExecUndo (this=<optimized out>, 
rReq=...)
         at sw/source/uibase/shells/basesh.cxx:669
     #12 0x00007b8ffe7fb3ef in SfxDispatcher::Call_Impl (this=0x5e9cb020, 
rShell=..., rSlot=..., rReq=..., bRecord=<optimized out>)
        at sfx2/source/control/dispatch.cxx:255
     #13 0x00007b8ffe802af7 in SfxDispatcher::Execute (this=0x5e9cb020, 
nSlot=<optimized out>,
         nCall=nCall@entry=SfxCallMode::SYNCHRON, 
pArgs=pArgs@entry=0x7fff18bf9ca0, 
pInternalArgs=pInternalArgs@entry=0x7fff18bf9c30,
         nModi=0) at sfx2/source/control/dispatch.cxx:813
    
    Change-Id: I3e3bd43f853521163581a7e2d575c1ebe7dc2bfb
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189352
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 4d48d43a68b5cdda15092d0ae9b25d48bce6d1de)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189406
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/core/layout/frmtool.cxx 
b/sw/source/core/layout/frmtool.cxx
index d4a62e26e105..64b937cba693 100644
--- a/sw/source/core/layout/frmtool.cxx
+++ b/sw/source/core/layout/frmtool.cxx
@@ -1909,11 +1909,14 @@ void InsertCnt_( SwLayoutFrame *pLay, SwDoc *pDoc,
                 continue; // skip it
             }
             assert(pActualSection && "Section end without section start?");
-            assert(pActualSection->GetSectionNode() == 
pNd->StartOfSectionNode());
 
             //Close the section, where appropriate activate the surrounding
             //section again.
-            pActualSection.reset(pActualSection->GetUpper());
+            if (pActualSection)
+            {
+                assert(pActualSection->GetSectionNode() == 
pNd->StartOfSectionNode());
+                pActualSection.reset(pActualSection->GetUpper());
+            }
             pLay = pLay->FindSctFrame();
             if ( pActualSection )
             {
commit fceefca2502341d6be3f53dbf7990461c61bece6
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Aug 11 08:35:56 2025 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Wed Aug 13 09:35:11 2025 +0200

    cid#1659737 Dereference after null check
    
    Change-Id: I2a3da97e7a9bceedb3b9940d5625010ab215fdaf
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189334
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit 1313be884c4ded639a5f53694c82a1cf2e77fe70)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189404
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/sw/source/uibase/dbui/dbmgr.cxx b/sw/source/uibase/dbui/dbmgr.cxx
index 022104934d8c..0fb2a04e2674 100644
--- a/sw/source/uibase/dbui/dbmgr.cxx
+++ b/sw/source/uibase/dbui/dbmgr.cxx
@@ -1329,7 +1329,9 @@ bool SwDBManager::MergeMailFiles(SwWrtShell* pSourceShell,
                     sPrefix = aEntry.GetMainURL( 
INetURLObject::DecodeMechanism::NONE );
                 }
 
-                OUString 
sExt(comphelper::string::stripStart(pStoreToFilter->GetDefaultExtension(), 
'*'));
+                OUString sExt;
+                if (pStoreToFilter)
+                    sExt = 
comphelper::string::stripStart(pStoreToFilter->GetDefaultExtension(), '*');
                 aTempFile.reset( new utl::TempFileNamed(sLeading, 
sColumnData.isEmpty(), sExt, &sPrefix, true) );
                 if( !aTempFile->IsValid() )
                 {

Reply via email to