From 539a0d00f9463412ab714ecc606118b6f4b08580 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 7 Aug 2014 16:20:44 +0100
Subject: coverity#704901 Dereference after null check

Change-Id: I1545151a71b44d85bbf1e990837154e4e1b6f3c4
---
 sw/source/core/layout/fly.cxx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index 2e4fd017ecbc..bcf92090f2a9 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -985,7 +985,7 @@ void SwFlyFrm::_UpdateAttr( const SfxPoolItem *pOld, const SfxPoolItem *pNew,
         case RES_URL:
             // The interface changes the frame size when interacting with text frames,
             // the Map, however, needs to be relative to FrmSize().
-            if ( (!Lower() || !Lower()->IsNoTxtFrm()) &&
+            if ( (!Lower() || !Lower()->IsNoTxtFrm()) && pNew && pOld &&
                  ((SwFmtURL*)pNew)->GetMap() && ((SwFmtURL*)pOld)->GetMap() )
             {
                 const SwFmtFrmSize &rSz = GetFmt()->GetFrmSize();
@@ -1006,6 +1006,7 @@ void SwFlyFrm::_UpdateAttr( const SfxPoolItem *pOld, const SfxPoolItem *pNew,
             break;
 
         case RES_CHAIN:
+            if (pNew)
             {
                 SwFmtChain *pChain = (SwFmtChain*)pNew;
                 if ( pChain->GetNext() )
-- 
cgit