diff options
| author | Caolán McNamara <caolan.mcnamara@collabora.com> | 2023-09-25 11:15:36 +0100 |
|---|---|---|
| committer | Michael Stahl <michael.stahl@allotropia.de> | 2023-11-24 21:58:21 +0100 |
| commit | b937306a5019b493e1f6f19d19140a69975c9f27 (patch) | |
| tree | 0772ed4289c3fa1c3849b195f2e3e19dee355d02 | |
| parent | c803721ad3d1b1d75e4115c9336da81b5ebeb8a3 (diff) | |
ofz#62688 Null-dereference READ in SwRubyPortion::SwRubyPortion
seen with fodt2pdf fuzzer
Change-Id: If761f5ecc473f4c936db82f3fcb7dd891e82573f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/157243
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit cc564cea7eda29ed7e98ea27056f3ab57a6e2027)
| -rw-r--r-- | sw/source/core/text/pormulti.cxx | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/sw/source/core/text/pormulti.cxx b/sw/source/core/text/pormulti.cxx index 3bd45fee2180..86e4381819b8 100644 --- a/sw/source/core/text/pormulti.cxx +++ b/sw/source/core/text/pormulti.cxx @@ -2357,6 +2357,11 @@ bool SwTextFormatter::BuildMultiPortion( SwTextFormatInfo &rInf, return bRet; } +static bool IsIncompleteRuby(const SwMultiPortion& rHelpMulti) +{ + return rHelpMulti.IsRuby() && static_cast<const SwRubyPortion&>(rHelpMulti).GetRubyOffset() < TextFrameIndex(COMPLETE_STRING); +} + // When a fieldportion at the end of line breaks and needs a following // fieldportion in the next line, then the "restportion" of the formatinfo // has to be set. Normally this happens during the formatting of the first @@ -2465,19 +2470,19 @@ SwLinePortion* SwTextFormatter::MakeRestPortion( const SwLineLayout* pLine, if (!pCreate) return pRest; - if( pRest || nMultiPos > nPosition || ( pHelpMulti->IsRuby() && - static_cast<const SwRubyPortion*>(pHelpMulti)->GetRubyOffset() < TextFrameIndex(COMPLETE_STRING))) + if( pRest || nMultiPos > nPosition || IsIncompleteRuby(*pHelpMulti)) { SwMultiPortion* pTmp; if( pHelpMulti->IsDouble() ) pTmp = new SwDoubleLinePortion( *pCreate, nMultiPos ); else if( pHelpMulti->IsBidi() ) pTmp = new SwBidiPortion( nMultiPos, pCreate->nLevel ); - else if( pHelpMulti->IsRuby() ) + else if (IsIncompleteRuby(*pHelpMulti)) { + TextFrameIndex nRubyOffset = static_cast<const SwRubyPortion*>(pHelpMulti)->GetRubyOffset(); pTmp = new SwRubyPortion( *pCreate, *GetInfo().GetFont(), m_pFrame->GetDoc().getIDocumentSettingAccess(), - nMultiPos, static_cast<const SwRubyPortion*>(pHelpMulti)->GetRubyOffset(), + nMultiPos, nRubyOffset, GetInfo() ); } else if( pHelpMulti->HasRotation() ) |