sw/source/core/undo/undobj1.cxx | 4 ++++ 1 file changed, 4 insertions(+)
New commits: commit 85415041a469cee0389244276dbd0035f81861a0 Author: Miklos Vajna <[email protected]> AuthorDate: Tue Feb 10 10:45:31 2026 +0100 Commit: Miklos Vajna <[email protected]> CommitDate: Wed Feb 11 10:22:50 2026 +0100 sw: fix crash in lcl_GetSwUndoId() gdb on the crashreport core dump: #0 SwNodeIndex::GetNodes (this=0x0) at sw/inc/ndindex.hxx:117 #1 SwNodeIndex::SwNodeIndex (nDiff=..., rIdx=..., this=0x7ffc29a667f0) at sw/inc/ndindex.hxx:67 #2 SwNodeIndex::SwNodeIndex (nDiff=1, rIdx=..., this=0x7ffc29a667f0) at sw/inc/ndindex.hxx:65 #3 lcl_GetSwUndoId (pFrameFormat=0x53c5c4e0) at sw/source/core/undo/undobj1.cxx:409 #4 SwUndoDelLayFormat::SwUndoDelLayFormat (this=this@entry=0x5477eb40, pFormat=pFormat@entry=0x53c5c4e0) at sw/source/core/undo/undobj1.cxx:426 I.e. it's possible that in lcl_GetSwUndoId(), rContent.GetContentIdx() returns a nullptr, so we can't unconditinally dereference that. Return early with a SwUndoId::DELLAYFMT in that case, matching what would happen if we would get a content index, which is not a graphic or OLE node. Change-Id: I0e6506ffc1506afe616d637571b181d2d6751e1a Reviewed-on: https://gerrit.libreoffice.org/c/core/+/199123 Reviewed-by: Miklos Vajna <[email protected]> Tested-by: Jenkins diff --git a/sw/source/core/undo/undobj1.cxx b/sw/source/core/undo/undobj1.cxx index e44a4519fc17..6c09ede713f4 100644 --- a/sw/source/core/undo/undobj1.cxx +++ b/sw/source/core/undo/undobj1.cxx @@ -405,6 +405,10 @@ lcl_GetSwUndoId(SwFrameFormat const *const pFrameFormat) { const SwFormatContent& rContent = pFrameFormat->GetContent(); OSL_ENSURE( rContent.GetContentIdx(), "Fly without content" ); + if (!rContent.GetContentIdx()) + { + return SwUndoId::DELLAYFMT; + } SwNodeIndex firstNode(*rContent.GetContentIdx(), 1); SwNoTextNode *const pNoTextNode(firstNode.GetNode().GetNoTextNode());
