commit 3b10bbacb8a12a00c35683eeaae4a75046a84aac
author Matt K <mattkse@gmail.com> Sat Jan 13 18:12:16 2024 -0600
committer Mike Kaganski <mike.kaganski@collabora.com> Sun Jan 14 05:43:00 2024 +0100
tree d0f3bf672db54a5b2740c12eeef9e79865bb72e6
parent 59927dedc31eb5d51b417a02ae927eb578b90bd6

tdf#159171 Prevent crash after selecting unprotected cells 2 times

The problem is that the code tries to check for a table on a clip-
board doc, but doesn't find any so it propagates nullptr back to
the caller, which is then used without being checked thereby
leading to a crash.  The fix is to check the result of the table
check of clipboard doc before doing any operations with it, thus
preventing the crash.

Change-Id: Ieb4a52d0c1cb713d5c14930e5e559e5bf520b330
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162033
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>

sc/source/ui/app/transobj.cxx

diff --git a/sc/source/ui/app/transobj.cxx b/sc/source/ui/app/transobj.cxx
index 6a1ef6a..5f0599c 100644
--- a/sc/source/ui/app/transobj.cxx
+++ b/sc/source/ui/app/transobj.cxx
@@ -312,28 +312,34 @@ bool ScTransferObj::GetData( const datatransfer::DataFlavor& rFlavor, const OUSt
            ScAddress aPos(nCol, nRow, nTab);

            const ScPatternAttr* pPattern = m_pDoc->GetPattern( nCol, nRow, nTab );
            ScTabEditEngine aEngine( *pPattern, m_pDoc->GetEditPool(), m_pDoc.get() );
            ScRefCellValue aCell(*m_pDoc, aPos);
            if (aCell.getType() == CELLTYPE_EDIT)
            if (pPattern)
            {
                const EditTextObject* pObj = aCell.getEditText();
                aEngine.SetTextCurrentDefaults(*pObj);
            }
            else
            {
                SvNumberFormatter* pFormatter = m_pDoc->GetFormatTable();
                sal_uInt32 nNumFmt = pPattern->GetNumberFormat(pFormatter);
                const Color* pColor;
                OUString aText = ScCellFormat::GetString(aCell, nNumFmt, &pColor, *pFormatter, *m_pDoc);
                if (!aText.isEmpty())
                    aEngine.SetTextCurrentDefaults(aText);
            }
                ScTabEditEngine aEngine(*pPattern, m_pDoc->GetEditPool(), m_pDoc.get());
                ScRefCellValue aCell(*m_pDoc, aPos);
                if (aCell.getType() == CELLTYPE_EDIT)
                {
                    const EditTextObject* pObj = aCell.getEditText();
                    aEngine.SetTextCurrentDefaults(*pObj);
                }
                else
                {
                    SvNumberFormatter* pFormatter = m_pDoc->GetFormatTable();
                    sal_uInt32 nNumFmt = pPattern->GetNumberFormat(pFormatter);
                    const Color* pColor;
                    OUString aText
                        = ScCellFormat::GetString(aCell, nNumFmt, &pColor, *pFormatter, *m_pDoc);
                    if (!aText.isEmpty())
                        aEngine.SetTextCurrentDefaults(aText);
                }

            bOK = SetObject( &aEngine,
                    ((nFormat == SotClipboardFormatId::RTF) ? SCTRANS_TYPE_EDIT_RTF :
                     ((nFormat == SotClipboardFormatId::EDITENGINE_ODF_TEXT_FLAT) ?
                      SCTRANS_TYPE_EDIT_ODF_TEXT_FLAT : SCTRANS_TYPE_EDIT_BIN)),
                    rFlavor );
                bOK = SetObject(&aEngine,
                                ((nFormat == SotClipboardFormatId::RTF)
                                     ? SCTRANS_TYPE_EDIT_RTF
                                     : ((nFormat == SotClipboardFormatId::EDITENGINE_ODF_TEXT_FLAT)
                                            ? SCTRANS_TYPE_EDIT_ODF_TEXT_FLAT
                                            : SCTRANS_TYPE_EDIT_BIN)),
                                rFlavor);
            }
        }
        else if ( ScImportExport::IsFormatSupported( nFormat ) || nFormat == SotClipboardFormatId::RTF
            || nFormat == SotClipboardFormatId::RICHTEXT )