reproduce with a dbgutil build loading forum-mso-en-4208.docx
sw/source/core/crsr/bookmark.cxx:294
sw::mark::Fieldmark::IsCoveringPosition(this=0x0)
writerfilter field import calls InsertFieldmark, which splits the
paragraph. SwTextNode::CutImpl moves the text, which already carries
the CH_TXT_ATR_FIELDSTART/FIELDSEP/FIELDEND dummy characters, to the
destination node before the fieldmarks themselves are repositioned.
relocating a content-control nesting hint then runs sw::CalcBreaks
over the destination node. getFieldmarkAt finds no mark at the
FIELDSTART character and the assert at the FIELDSEP character
dereferences the null pushed for it.
keep pushing the possibly-null mark so start, separator and end stay
paired on the stack, and let the two asserts accept a null top entry.
The loop at the end over the still-open fields already handles a null
mark.
a similar guard existed since:
commit b3325ef8cd
Date: Sat Nov 6 16:40:17 2021 +0000
ofz40766 Null-dereference
until:
commit a7116b890c
Date: Tue Nov 16 14:28:15 2021 +0100
ofz#40766 svtools, sw: HTMLParser: really stop inserting control chars
removed it when the source of stray control characters was fixed
instead. Here the field characters are legitimate and only the mark
repositioning lags behind.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I9c7a33f5fac614645e420152c490765b53a7004c
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6714
Tested-by: Michael Stahl <michael.stahl@collabora.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 274d1402efe96b367be1cf0fdfe7edd3641c9df2)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208770
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Caolán McNamara
053a52ec3d