| commit | 058fdc75afa9e5e69c6e11ab7879ddb9d51ae1c5 | [log] |
|---|---|---|
| author | Caolán McNamara <caolanm@redhat.com> | Sat Jun 13 15:55:33 2020 +0100 |
| committer | Caolán McNamara <caolanm@redhat.com> | Sat Jun 13 18:13:22 2020 +0200 |
| tree | 54c29e77865ac68ae009f010272cd777a62f107e | |
| parent | 9debed4ca680706da74824f7d46198ac0e422f80 [diff] |
crashtesting: null deref in SwCellFrame::GetLayoutRowSpan seen with swtextframe_connectfootnote_heap_use_after_free.sample Change-Id: I98da2e67065c5890d74e5f33ffc01329ff75f185 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/96257 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com>
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx index 0a3e5f9..2642c50 100644 --- a/sw/source/core/layout/tabfrm.cxx +++ b/sw/source/core/layout/tabfrm.cxx
@@ -5366,7 +5366,8 @@ void SwCellFrame::Modify( const SfxPoolItem* pOld, const SfxPoolItem * pNew ) long SwCellFrame::GetLayoutRowSpan() const { long nRet = GetTabBox()->getRowSpan(); const SwTableBox *pTabBox = GetTabBox(); long nRet = pTabBox ? pTabBox->getRowSpan() : 0; if ( nRet < 1 ) { const SwFrame* pRow = GetUpper();