From 3cf840fabf8218deec7aec4901644d93414ac9af Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 27 Oct 2020 10:12:37 +0000
Subject: ofz#26676 null deref
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Ic2bd8b49762266ad48263bd68a143b46fb5fd66f
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104863
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit 9bf58fd45814f10ecf6131aeeec86123a383723f)
---
 lotuswordpro/source/filter/lwptablelayout.cxx | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lotuswordpro/source/filter/lwptablelayout.cxx b/lotuswordpro/source/filter/lwptablelayout.cxx
index b4805ae6d9af..6357bcc83862 100644
--- a/lotuswordpro/source/filter/lwptablelayout.cxx
+++ b/lotuswordpro/source/filter/lwptablelayout.cxx
@@ -879,7 +879,14 @@ sal_uInt16 LwpTableLayout::ConvertHeadingRow(
             XFRow* pXFRow = pTmpTable->GetRow(1);
             pXFTable->AddHeaderRow(pXFRow);
             pTmpTable->RemoveRow(1);
-            nContentRow = m_RowsMap[0]->GetCurMaxSpannedRows(0,nCol);
+            auto iter = m_RowsMap.find(0);
+            if (iter == m_RowsMap.end())
+            {
+                SAL_WARN("lwp", "row 0 is unknown");
+                nContentRow = 0;
+            }
+            else
+                nContentRow = iter->second->GetCurMaxSpannedRows(0,nCol);
         }
     }
     return nContentRow;
-- 
cgit