From d3fca73f81dfb19a72a0da41598b7390eaf5845b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Sun, 13 Sep 2026 15:18:40 +0000 Subject: [PATCH] ofz#558289050 Null-dereference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit the cast of the text cursor isn't checked, unlike the paragraph cursor a few lines later Signed-off-by: Caolán McNamara Change-Id: I11bb7b9ea9f2b22978da57e37edab76d67c0f195 Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12356 Reviewed-by: Noel Grandin Tested-by: Jenkins CPCI (cherry picked from commit d83c2c6937dcfccf3e59459b78610acdd9aad2d3) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211411 Reviewed-by: Xisco Fauli Tested-by: Jenkins --- sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx b/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx index 94ad99969c33..8c54cc99b745 100644 --- a/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx +++ b/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx @@ -3067,6 +3067,8 @@ void DomainMapper_Impl::finishParagraph( const ParagraphPropertyMapPtr& pParaCon // table style has got bigger precedence than docDefault style // collect these pending paragraph properties to process in endTable() rtl::Reference xCur = dynamic_cast(xTextRange->getText( )->createTextCursor().get()); + if (!xCur) + throw uno::RuntimeException(); xCur->gotoEnd(false); xCur->goLeft(1, false); rtl::Reference xParaCursor = dynamic_cast