commit 2dfae8e4881e78fddd3bbd6dedc5dd0ab814f685
author Mike Kaganski <mike.kaganski@collabora.com> Sun Apr 28 13:44:08 2019 +0300
committer Mike Kaganski <mike.kaganski@collabora.com> Sun Apr 28 16:03:17 2019 +0200
tree 1824ea92ec726ecc53a6d9935204b366adbe0161
parent 6be4694ab84217d195091d2b9a0e7c74199f5fc1

tdf#120703 PVS: nullptr dereference

V595 The 'GetMedium()' pointer was utilized before it was verified against nullptr.
     Check lines: 435, 455.

bURLChanged is only meaningful when GetMedium() is not nullptr;
otherwise bSaveDS could become true where no medium existed,
and dereferencing GetMedium() to find its URL would segfault.

Change-Id: I6f533acb3b1ca078803aa23bdece0ba2ee1d87c3
Reviewed-on: https://gerrit.libreoffice.org/71467
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

sw/source/uibase/app/docsh.cxx

diff --git a/sw/source/uibase/app/docsh.cxx b/sw/source/uibase/app/docsh.cxx
index 4ad1527..7f13bbb 100644
--- a/sw/source/uibase/app/docsh.cxx
+++ b/sw/source/uibase/app/docsh.cxx
@@ -426,6 +426,7 @@
        !m_xDoc->getIDocumentSettingAccess().get(DocumentSettingId::GLOBAL_DOCUMENT_SAVE_LINKS))
        RemoveOLEObjects();

    if (GetMedium())
    {
        // Task 75666 - is the Document imported by our Microsoft-Filters?
        std::shared_ptr<const SfxFilter> pOldFilter = GetMedium()->GetFilter();
@@ -448,8 +449,8 @@

    CalcLayoutForOLEObjects();  // format for OLE objects

    const bool bURLChanged = !GetMedium() || GetMedium()->GetURLObject() != rMedium.GetURLObject();
    auto pMgr = m_xDoc->GetDBManager();
    const bool bURLChanged = GetMedium() && GetMedium()->GetURLObject() != rMedium.GetURLObject();
    const SwDBManager* const pMgr = m_xDoc->GetDBManager();
    const bool bHasEmbedded = pMgr && !pMgr->getEmbeddedName().isEmpty();
    bool bSaveDS = bHasEmbedded && bURLChanged;
    if (bSaveDS)
@@ -474,7 +475,7 @@
        xUri = css::uri::VndSunStarPkgUrlReferenceFactory::create(xContext)->createVndSunStarPkgUrlReference(xUri);
        assert(xUri.is());
        OUString const aURL = xUri->getUriReference() + "/"
            + INetURLObject::encode(m_xDoc->GetDBManager()->getEmbeddedName(),
            + INetURLObject::encode(pMgr->getEmbeddedName(),
                INetURLObject::PART_FPATH, INetURLObject::EncodeMechanism::All);

        bool bCopyTo = GetCreateMode() == SfxObjectCreateMode::EMBEDDED;
@@ -488,7 +489,7 @@
        uno::Reference<sdb::XDocumentDataSource> xDataSource(xDatabaseContext->getByName(aURL), uno::UNO_QUERY);
        uno::Reference<frame::XStorable> xStorable(xDataSource->getDatabaseDocument(), uno::UNO_QUERY);
        SwDBManager::StoreEmbeddedDataSource(xStorable, rMedium.GetOutputStorage(),
                                             m_xDoc->GetDBManager()->getEmbeddedName(),
                                             pMgr->getEmbeddedName(),
                                             rMedium.GetName(), bCopyTo);
    }