Caolán McNamara
053a52ec3d
reproduce with a dbgutil build loading forum-mso-en-4208.docx
sw/source/core/crsr/bookmark.cxx:294
sw::mark::Fieldmark::IsCoveringPosition(this=0x0)
writerfilter field import calls InsertFieldmark, which splits the
paragraph. SwTextNode::CutImpl moves the text, which already carries
the CH_TXT_ATR_FIELDSTART/FIELDSEP/FIELDEND dummy characters, to the
destination node before the fieldmarks themselves are repositioned.
relocating a content-control nesting hint then runs sw::CalcBreaks
over the destination node. getFieldmarkAt finds no mark at the
FIELDSTART character and the assert at the FIELDSEP character
dereferences the null pushed for it.
keep pushing the possibly-null mark so start, separator and end stay
paired on the stack, and let the two asserts accept a null top entry.
The loop at the end over the still-open fields already handles a null
mark.
a similar guard existed since:
commit b3325ef8cd
Date: Sat Nov 6 16:40:17 2021 +0000
ofz40766 Null-dereference
until:
commit a7116b890c
Date: Tue Nov 16 14:28:15 2021 +0100
ofz#40766 svtools, sw: HTMLParser: really stop inserting control chars
removed it when the source of stray control characters was fixed
instead. Here the field characters are legitimate and only the mark
repositioning lags behind.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I9c7a33f5fac614645e420152c490765b53a7004c
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6714
Tested-by: Michael Stahl <michael.stahl@collabora.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 274d1402efe96b367be1cf0fdfe7edd3641c9df2)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208770
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Files with the string 'CVE' in their name are encrypted to avoid problems with virus checkers on source code download.; use: mdecrypt --bare -a arcfour -o hex -k 435645 -s 3 foo.doc # to unencrypt mcrypt --bare -a arcfour -o hex -k 435645 -s 3 foo.doc # to create new tests to get access to the plain files for manual testing. The files in these subdirectories are tested to ensure that they import without crashing or hanging. Files that crash during export should go into exportdata. Both data and exportdata are tested with make CppunitTest_sw_filters_test or make CppunitTest_sw_filters_test2 for ww6. Files that hang interactively, but pass filters_test might be failing because of layout issues. See core/layout. pass: these files now load - without the fix they crashed or hung. fail: these files still fail to load, but not because of crashing or hanging. indeterminate: untested temporary holding area - to be sorted as pass/fail.