sd/source/ui/sidebar/MasterPagesSelector.cxx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
New commits: commit 87746ace065660e5eb59b2b3370f18905d0ccfe1 Author: Andras Timar <[email protected]> AuthorDate: Sat Feb 21 16:37:17 2026 +0100 Commit: Miklos Vajna <[email protected]> CommitDate: Tue Feb 24 11:23:15 2026 +0100 fix SIGSEGV in MasterPagesSelector on CHILD_REMOVED event GetIndexForToken() returns -1 when the token is not found in the index map (e.g. during document load when the sidebar hasn't been fully populated yet). The CHILD_REMOVED case was passing this unchecked -1 to SetItem(), where it got implicitly converted to sal_uInt16 (65535), causing remove() on a non-existent entry and a null pointer dereference in SvTreeList::Remove(). Add the missing bounds check, matching the pattern already used in the PREVIEW_CHANGED case. Change-Id: Ice85a6b0df6cd1d6f9603c8f81376c1bddc246f6 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/199946 Tested-by: Jenkins CollaboraOffice <[email protected]> Reviewed-by: Miklos Vajna <[email protected]> diff --git a/sd/source/ui/sidebar/MasterPagesSelector.cxx b/sd/source/ui/sidebar/MasterPagesSelector.cxx index 0d3d8470d361..e31d0faa3b1e 100644 --- a/sd/source/ui/sidebar/MasterPagesSelector.cxx +++ b/sd/source/ui/sidebar/MasterPagesSelector.cxx @@ -379,7 +379,8 @@ void MasterPagesSelector::NotifyContainerChangeEvent (const MasterPageContainerC case MasterPageContainerChangeEvent::EventType::CHILD_REMOVED: { int nIndex (GetIndexForToken(rEvent.maChildToken)); - SetItem(nIndex, MasterPageContainer::NIL_TOKEN); + if (nIndex >= 0) + SetItem(nIndex, MasterPageContainer::NIL_TOKEN); break; }
