null-deref seen in ScTabView::UpdateEditView

#0  0x00007f2bcc41df63 in ScViewData::GetCurYForTab (this=this@entry=0x3502d0b8, nTabIndex=nTabIndex@entry=6)
at libreoffice/sc/source/ui/view/viewdata.cxx:1443
#1  0x00007f2bcc3ebf02 in ScTabView::UpdateEditView (this=this@entry=0x3502d0b0) at libreoffice/sc/source/ui/view/tabview3.cxx:2185
#2  0x00007f2bcc3ec636 in ScTabView::UpdateFormulas (this=this@entry=0x3502d0b0, nStartCol=nStartCol@entry=-1, nStartRow=nStartRow@entry=-1, nEndCol=nEndCol@entry=-1,
nEndRow=nEndRow@entry=-1) at libreoffice/sc/source/ui/view/tabview3.cxx:2327
#3  0x00007f2bcc40735c in ScTabViewShell::Notify (this=0x3502cf20, rBC=..., rHint=...) at libreoffice/sc/source/ui/view/tabvwsh5.cxx:216
#4  0x00007f2bdc1885a9 in SfxBroadcaster::Broadcast (this=this@entry=0x31e31430, rHint=...)
at libreoffice/svl/source/notify/SfxBroadcaster.cxx:40
#5  0x00007f2bcc022e6d in ScDocShell::PostDataChanged (this=this@entry=0x31e31430) at libreoffice/sc/source/ui/docshell/docsh3.cxx:95
#6  0x00007f2bcc0101aa in ScDocShell::SetDocumentModified (this=0x31e31430) at libreoffice/sc/source/ui/docshell/docsh.cxx:3015
#7  0x00007f2bcc010df3 in ScDocShellModificator::SetDocumentModified (this=this@entry=0x7fff2d168da0)
at libreoffice/sc/source/ui/docshell/docsh.cxx:3330
#8  0x00007f2bcc040c1a in ScDocShell::MoveTable (this=this@entry=0x31e31430, nSrcTab=<optimized out>, nDestTab=<optimized out>, bCopy=bCopy@entry=false, bRecord=bRecord@entry=false)
at libreoffice/sc/source/ui/docshell/docsh5.cxx:1010
#9  0x00007f2bcc441a41 in ScViewFunc::MoveTable (this=this@entry=0x333d0fe0, nDestDocNo=nDestDocNo@entry=0, nDestTab=nDestTab@entry=7, bCopy=bCopy@entry=false,
pNewTabName=pNewTabName@entry=0x7fff2d169068) at libreoffice/sc/source/ui/view/viewfun2.cxx:3117
#10 0x00007f2bcc418459 in ScTabViewShell::ExecuteTable (this=0x333d0e50, rReq=...) at libreoffice/sc/source/ui/view/tabvwshf.cxx:593
#11 0x00007f2bdbd3d96f in SfxDispatcher::Call_Impl (this=this@entry=0x33379ed0, rShell=..., rSlot=..., rReq=..., bRecord=<optimized out>)
at libreoffice/sfx2/source/control/dispatch.cxx:254
#12 0x00007f2bdbd427ee in SfxDispatcher::Execute_ (this=this@entry=0x33379ed0, rShell=..., rSlot=..., rReq=..., eCallMode=eCallMode@entry=SfxCallMode::RECORD)
at libreoffice/sfx2/source/control/dispatch.cxx:753
#13 0x00007f2bdbd45a33 in SfxDispatcher::Execute (this=0x33379ed0, nSlot=<optimized out>, nCall=nCall@entry=SfxCallMode::RECORD, pArgs=pArgs@entry=0x7fff2d1694a0,
pInternalArgs=pInternalArgs@entry=0x7fff2d169460, nModi=nModi@entry=0) at libreoffice/sfx2/source/control/dispatch.cxx:813
#14 0x00007f2bdbd83c0f in SfxDispatchController_Impl::dispatch (this=<optimized out>, aURL=..., aArgs=..., rListener=...)

we have nulls in here for hidden sheets

Change-Id: I8f1295e67552f3ec9306a031aaecd0838e18d98d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158502
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
(cherry picked from commit ce8920448c05594f37f09c7a42ae3f3c7ccb7a1e)

1 files changed, 30 insertions, 4 deletions

diff --git a/sc/source/ui/view/viewdata.cxx b/sc/source/ui/view/viewdata.cxx
index 0ea25ebce6de..9103af9811a8 100644
--- a/sc/source/ui/view/viewdata.cxx
+++ b/sc/source/ui/view/viewdata.cxx
@@ -1342,7 +1342,13 @@ SCCOL ScViewData::GetCurXForTab( SCTAB nTabIndex ) const
     if (!ValidTab(nTabIndex) || (nTabIndex >= static_cast<SCTAB>(maTabData.size())))
         return -1;
 
-    return maTabData[nTabIndex]->nCurX;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::GetCurXForTab : hidden sheet = " << nTabIndex);
+        return -1;
+    }
+    return pTabData->nCurX;
 }
 
 SCROW ScViewData::GetCurYForTab( SCTAB nTabIndex ) const
@@ -1350,7 +1356,13 @@ SCROW ScViewData::GetCurYForTab( SCTAB nTabIndex ) const
     if (!ValidTab(nTabIndex) || (nTabIndex >= static_cast<SCTAB>(maTabData.size())))
             return -1;
 
-    return maTabData[nTabIndex]->nCurY;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::GetCurYForTab : hidden sheet = " << nTabIndex);
+        return -1;
+    }
+    return pTabData->nCurY;
 }
 
 void ScViewData::SetCurXForTab( SCCOL nNewCurX, SCTAB nTabIndex )
@@ -1358,7 +1370,14 @@ void ScViewData::SetCurXForTab( SCCOL nNewCurX, SCTAB nTabIndex )
     if (!ValidTab(nTabIndex) || (nTabIndex >= static_cast<SCTAB>(maTabData.size())))
             return;
 
-    maTabData[nTabIndex]->nCurX = nNewCurX;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::SetCurXForTab : hidden sheet = " << nTabIndex);
+        return;
+    }
+
+    pTabData->nCurX = nNewCurX;
 }
 
 void ScViewData::SetCurYForTab( SCCOL nNewCurY, SCTAB nTabIndex )
@@ -1366,7 +1385,14 @@ void ScViewData::SetCurYForTab( SCCOL nNewCurY, SCTAB nTabIndex )
     if (!ValidTab(nTabIndex) || (nTabIndex >= static_cast<SCTAB>(maTabData.size())))
             return;
 
-    maTabData[nTabIndex]->nCurY = nNewCurY;
+    ScViewDataTable* pTabData = maTabData[nTabIndex].get();
+    if (!pTabData)
+    {
+        SAL_WARN("sc.viewdata", "ScViewData::SetCurYForTab : hidden sheet = " << nTabIndex);
+        return;
+    }
+
+    pTabData->nCurY = nNewCurY;
 }
 
 void ScViewData::SetMaxTiledCol( SCCOL nNewMaxCol )