ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz#556994536 Null-dereference

Browse Source 
\cell can arrive before \intbl, so the buffered cell end has no cell
properties to be replayed with

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ia94d2d7cd3179784db3dcf1bdbf8cf3b7fd2d2de
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11286
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit cf9a5ad073aa6cac8bb2ad3a24640ee3663b9b41)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211596
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-09-30 11:35:52 +02:00
committed by Xisco Fauli
parent 6a22c3e9a2
commit f3f25e07f9
3 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sw/qa/writerfilter/rtftok/data/cell-then-intbl.rtf
+1
View File
@@ -0,0 +1 @@
{\rtf1\cell x\intbl}
sw/qa/writerfilter/rtftok/rtfdispatchsymbol.cxx
+17
View File
@@ -84,6 +84,23 @@ CPPUNIT_TEST_FIXTURE(Test, testFloattableThenSectBreak)
// i.e. the floating table was on the 2nd page, not on the 1st page.
assertXPath(pXmlDoc, "/root/page[1]/sorted_objs/fly", 1);
}
CPPUNIT_TEST_FIXTURE(Test, testCellThenIntbl)
{
// Given a document where the \intbl comes after the \cell:
// When loading that file:
loadFromFile(u"cell-then-intbl.rtf");
// Then make sure that the text after the cell end is in the document:
uno::Reference<text::XTextDocument> xTextDocument(mxComponent, uno::UNO_QUERY);
uno::Reference<container::XEnumerationAccess> xText(xTextDocument->getText(), uno::UNO_QUERY);
uno::Reference<container::XEnumeration> xParagraphs = xText->createEnumeration();
uno::Reference<text::XTextRange> xParagraph(xParagraphs->nextElement(), uno::UNO_QUERY);
// Without the accompanying fix in place, this test would have failed, the import replayed
// the buffered cell end with no properties to put it in.
CPPUNIT_ASSERT_EQUAL(u"x"_ustr, xParagraph->getString());
CPPUNIT_ASSERT(!xParagraphs->hasMoreElements());
}
}
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
sw/source/writerfilter/rtftok/rtfdispatchsymbol.cxx
+1
View File
@@ -142,6 +142,7 @@ RTFError RTFDocumentImpl::dispatchSymbol(RTFKeyword nKeyword)
pCurrentBuffer->begin(), pCurrentBuffer->end(),
[](auto const& it) {
return ::std::get<0>(it) == RTFBufferTypes::PAR
|| ::std::get<0>(it) == RTFBufferTypes::CellEnd
|| (::std::get<0>(it) == RTFBufferTypes::Props
&& ::std::get<1>(it)->getSprms().find(
NS_ooxml::LN_inTbl)